Kaiten

Kaiten, also known as Tsunami, is a malware variant that operates as a Distributed Denial of Service (DDoS) bot and an IRC bot. It targets vulnerable Internet of Things (IoT) devices and poorly protected Linux SSH servers, often being distributed alongside other DDoS bots like Mirai and Gafgyt. The Tsunami variant employed in recent hacking campaigns, as reported by AhnLab Security Emergency Response Center (ASEC), is a Kaiten variant known as Ziggy. To maintain persistence and avoid detection, this bot writes itself on the "/etc/rc.local" file and changes the name of the currently running process to "[kworker/0:0]". The backdoor of this malware runs a secondary payload embedded in the shell script vars.sh, which is a slightly modified version of ZiggyStarTux, an open-source IRC bot based on the Kaiten malware. If the target file does not exist, the script downloads and executes the malicious binary from its file server, saving it to the directory /usr/sbin/. This downloaded binary could potentially be ZiggyStarTux. The backdoor also runs a modified version of a Kaiten malware-based DDoS client called ZiggyStarTux that executes bash commands received from the attacker's Command and Control (C2) server. In addition to facilitating DDoS attacks, Kaiten has been implicated in stealthy cryptocurrency mining operations. Poorly managed Linux servers are being breached to deliver DDoS bots such as ShellBot and Tsunami (aka Kaiten) and to covertly exploit resources for cryptocurrency mining. Other malware strains designed for similar environments include the Hildegard trojan, Siloscape backdoor, Kaiten botnet, and XMRig Monero miner. The ongoing attack campaign involves the installation of the Tsunami (another name for Kaiten) DDoS bot on inadequately managed Linux SSH servers.