securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * Healthcare - Patient or Perpetrator? – The Cybercriminals Within
 * Operation Cyclone targets Clop Ransomware affiliates
 * Nation-state actors target critical sectors by exploiting the CVE-2021-40539
   flaw
 * Hungarian official confirms Hungary used NSO Group Pegasus spyware
 * FBI warns of fraudulent schemes using cryptocurrency ATMs and QR for payments
 * Experts spotted a phishing campaign impersonating security firm Proofpoint



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


NEW GOLANG-BASED CRYPTO WORM INFECTS WINDOWS AND LINUX SERVERS

December 31, 2020  By Pierluigi Paganini


Powered by pixfutureⓘ


EXPERTS FROM INTEZER DISCOVERED A NEW AND SELF-SPREADING GOLANG-BASED MALWARE
THAT TARGETS WINDOWS AND LINUX SERVERS.

Experts from Intezer discovered a Golang-based worm that targets Windows and
Linux servers.

Powered by pixfutureⓘ

The malware has been active since early December targeting public-facing
services, including MySQL, Tomcat admin panel and Jenkins that are protected
with weak passwords.



The worm spreads by scanning for systems and running a credential spraying brute
force attack. The malware leverages a hardcoded dictionary of weak credentials
for the attack, such as root:123456.

Experts pointed out that an older version of the worm also attempted to exploit
CVE-2020-14882 WebLogic’s vulnerability.

The attacks observed by the experts use three files hosted on the same C&C, a
dropper script (bash or powershell), a Golang binary worm, and the XMRig Miner.

The threat actors behind this campaign have been actively updating the malicious
code.

“The ELF worm binary and the bash dropper script are both fully undetected in
VirusTotal at the time of this publication.” reads the analysis. “The malware
behaves similarly on both Linux and Windows operating systems.”

Upon compromising a server, the malware deploys the loader script (ld.sh for
Linux and ld.ps1 for Windows) that drops the XMRig miner and Golang-based worm
binary.

The Linux variant of the worm checks if a process on the infected machine is
listening on port 52013. The presence of the listener on this port acts as a
mutex for the malicious code, it kills itself if it detects a socket for the
port otherwise it will open its own socket.

Experts detailed the attack chain for both Linux and Windows servers, they also
provided the following list of precautions to prevent brute force attacks and
vulnerability exploits:

 1. Use complex passwords, limit login attempts and use 2FA (Two-Factor
    Authentication) if possible.
 2. Minimize your use of publicly facing services.
 3. Keep your software updated with the latest security patches.
 4. Use a Cloud Workload Protection Platform (CWPP), like Intezer Protect, to
    gain full runtime visibility over the code in your system and get alerted on
    any malicious or unauthorized code. We have a free community edition.

“In 2020, we saw a noticeable trend of Golang malware targeting different
platforms, including Windows, Linux, Mac and Android. We assess with high
confidence that this will continue in 2021.” conclude the experts.

“The fact that the worm’s code is nearly identical for both its PE and ELF
malware—and the ELF malware going undetected in VirusTotal—demonstrates that
Linux threats are still flying under the radar for most security and detection
platforms.”

If you want to receive the weekly Security Affairs Newsletter for free
subscribe here.



Pierluigi Paganini

(SecurityAffairs – hacking, Golang-based worm)





Powered by pixfutureⓘ





Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


cryptocurrency malwareGoLang based wormHackinghacking newsinformation security
newsIT Information SecuritymalwarePierluigi PaganiniSecurity AffairsSecurity
News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Emotet campaign hits Lithuania's National Public Health Center and several state
institutions

NEXT ARTICLE

Threat actor is selling 368.8 million records from 26 data breaches

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


HEALTHCARE – PATIENT OR PERPETRATOR? – THE CYBERCRIMINALS WITHIN

November 8, 2021  By Pierluigi Paganini

OPERATION CYCLONE TARGETS CLOP RANSOMWARE AFFILIATES

November 8, 2021  By Pierluigi Paganini






 * SPONSORED CONTENT
   
   
 * 


 * PIXFUTURE


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER




More Story

EMOTET CAMPAIGN HITS LITHUANIA'S NATIONAL PUBLIC HEALTH CENTER AND SEVERAL STATE
INSTITUTIONS

An Emotet campaign hit Lithuania, the malware has infected systems at the
National Center for Public Health (NVSC) and several...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

This site uses cookies, including for analytics, personalization, and
advertising purposes. For more information or to change your cookie settings,
click here.

If you continue to browse this site without changing your cookie settings, you
agree to this use.
Accept Read More
Privacy and Cookies Policy
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT