Modded Perlbot V2

Modded Perlbot v2 is a new strain of the ShellBot DDoS bot malware that has been identified as part of an attack campaign targeting mismanaged Linux SSH servers. This campaign, which began on March 22, 2023, involves the distribution of three distinct strains of the ShellBot malware: PowerBots GohacK, LiGhT's Modded perlbot v2, and DDoS PBot v2.0. These new strains were discovered and categorized by researchers who noted that threat actors could create their own versions, leading to the classification into these three groups. LiGhT’s Modded perlbot v2, along with DDoS PBot v2.0, supports multiple DDoS attack commands using HTTP, TCP, and UDP protocols. These commands facilitate distributed denial-of-service attacks, a common malicious tactic to disrupt network services. On the other hand, PowerBots GohacK is more akin to a backdoor malware, providing capabilities for reverse shell access and arbitrary file uploading. This information was revealed in a report from the AhnLab Security Emergency Response Center. The ShellBot malware, including the Modded perlbot v2 variant, is highly customizable, allowing different capabilities and attack methods to be tailored by various threat actors. This flexibility makes it a potent threat, capable of adapting to different environments and security measures. The emergence of these new strains underscores the need for robust vulnerability management strategies, particularly for Linux SSH servers, to prevent exploitation and maintain system integrity.