Perlbot

PerlBot, also known as ShellBot, is a harmful malware developed using the Perl programming language. This Distributed Denial of Service (DDoS) bot is designed to exploit poorly managed Linux SSH servers, primarily through dictionary attacks on weak SSH credentials. It uses the IRC protocol for Command and Control (C2) communications, enabling it to steal information, disrupt operations, and potentially hold data hostage. The malware can be delivered to systems via suspicious downloads, emails, or websites without the user's knowledge. Researchers from AhnLab Security Emergency Response Center (ASEC) have categorized PerlBot into three distinct groups: LiGhT’s Modded perlbot v2, DDoS PBot v2.0, and PowerBots (C) GohacK. These versions support multiple DDoS attack commands using HTTP, TCP, and UDP protocols. In March 2023, ASEC disclosed that mismanaged Linux SSH servers were being targeted by these new strains of ShellBot malware, leading to a significant increase in cyberattacks. The abuse of vulnerabilities such as CVE-2022-46169 and CVE-2021-35394 has been observed in delivering PerlBot, according to Fortinet FortiGuard Labs. The high CVSS scores of these vulnerabilities (9.8 each) indicate their severity and potential impact. To mitigate the risks associated with PerlBot, organizations are advised to manage their Linux SSH servers properly, keep software up-to-date, and implement robust security measures.