Shellbot

ShellBot is a malicious software (malware) variant that has been actively targeting poorly managed Linux SSH servers. As reported by Hacker News and HackRead in March 2023, this Perl-based DDoS bot deploys different variants to exploit these servers. ShellBot, along with another DDoS malware called Tsunami, are distributed by the same threat actor. The malware is highly customizable, with various versions offering different capabilities and attack methods. Notably, ShellBot uses the IRC protocol for Command & Control (C&C) communication, enabling it to receive commands like executing remote tasks or launching DDoS attacks without needing a custom C&C infrastructure. After gaining access to a system, ShellBot is installed and often achieves persistence by modifying startup scripts or cron jobs. Once installed, it connects to a C&C server via the IRC protocol, enabling attackers to issue commands, steal data, and launch DDoS attacks. ASEC reported on March 13, 2023, that ShellBot was actively targeting Linux SSH servers. By September 12, 2024, samples of ShellBot were found alongside a malware called SUPERSHELL. The attribution of these attacks is challenging, but there is speculation of involvement from Romanian threat actors, possibly linked to the 'Outlaw APT' group. ShellBot exploits vulnerabilities such as the Cacti bug to infect systems. Since January 2023, several malware botnet attacks have sought to spread Moobot and ShellBot through the exploitation of a critical Cacti command injection bug (CVE-2022-46169) and a critical Realtek Jungle SDK remote code execution flaw (CVE-2021-35394). These threat actors are also involved in the development and sale of cyber weapons, an activity that is not very common. Therefore, ensuring adequate vulnerability management and maintaining up-to-date security measures are crucial in preventing ShellBot infections.