Shellbot

ShellBot is a malicious software (malware) that has been targeting poorly managed Linux SSH servers. The malware, which was detected in multiple variants, is primarily being used to carry out distributed denial-of-service (DDoS) attacks. ShellBot exploits the Cacti bug and uses it as a primary leverage point for its operations. Additionally, it has been linked with other DDoS malware such as Tsunami. The threat actors behind this campaign are suspected to be Romanian, possibly having connections with the 'Outlaw APT' group and others who use Perl Shellbot. They are also involved in the development and sale of cyber weapons. Since January 2023, there have been numerous botnet attacks attempting to spread ShellBot and Moobot malware by exploiting critical vulnerabilities like the Cacti command injection bug (CVE-2022-46169) and the Realtek Jungle SDK remote code execution flaw (CVE-2021-35394). In April 2023, FortiGuard Labs researchers observed a hacking campaign specifically targeting these vulnerabilities to propagate ShellBot and Moobot malware. These attacks were not limited to just DDoS activities but also included unauthorized cryptocurrency mining. The hackers have been found to brute-force Linux SSH servers to deploy their malware, including ShellBot, Tsunami DDoS bot, log cleaners, privilege escalation tools, and an XMRig (Monero) coin miner. Once installed, ShellBot enables the compromised Linux servers to be used as DDoS bots for attacks against specific targets. It can also install additional malware or launch various types of attacks from the compromised server. The attackers typically initiate a dictionary attack on systems with open SSH port 22 using various SSH credentials, followed by payload deployment and the use of the Internet Relay Chat protocol for command-and-control server communications.