Agoent

AGoent is a sophisticated malware, a malicious software designed to exploit and damage computer systems. This Golang-based agent bot has been observed in multiple attacks, exploiting a year-old vulnerability to launch various nefarious activities. It operates by fetching the script file "exec.sh" from an attacker-controlled website, which then retrieves the Executable and Linkable Format (ELF) files of different Linux-based architectures. Capable of executing a wide range of malicious actions, AGoent can carry out DDoS attacks, cryptocurrency mining, and installation of additional malware. Its complex behaviors are aimed at evading detection and establishing persistence in the systems it infects. Recently, researchers at Fortinet have reported an increase in attacks targeting this particular vulnerability. The attacks, observed over the past month, have involved several botnets including Moobot, Miori, AGoent, a Gafgyt variant, and an unnamed variant of the infamous Mirai botnet. These threat actors are exploiting unpatched devices to dispatch their botnets, compromising them for DDoS and other harmful activities. The rise in these attacks underscores the importance of maintaining up-to-date security patches on all devices. Unpatched devices provide an easy avenue for these threat actors to dispatch botnets like AGoent and others. The ongoing threat posed by AGoent and similar botnets highlights the critical need for robust cybersecurity measures, including regular system updates and vigilant monitoring for suspicious activity.