{"id":19094,"date":"2022-05-19T09:00:51","date_gmt":"2022-05-19T17:00:51","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/05\/19\/news-12827\/"},"modified":"2022-05-19T09:00:51","modified_gmt":"2022-05-19T17:00:51","slug":"news-12827","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/05\/19\/news-12827\/","title":{"rendered":"Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices"},"content":{"rendered":"

Credit to Author: Katie McCafferty| Date: Thu, 19 May 2022 16:00:00 +0000<\/strong><\/p>\n

In the last six months, we observed a 254% increase in activity from a Linux trojan called XorDdos. First discovered in 2014 by the research group MalwareMustDie, XorDdos was named after its denial-of-service-related activities on Linux endpoints and servers as well as its usage of XOR-based encryption for its communications.<\/p>\n

XorDdos depicts the trend of malware increasingly targeting Linux-based operating systems, which are commonly deployed on cloud infrastructures and Internet of Things (IoT) devices. By compromising IoT and other internet-connected devices, XorDdos amasses botnets that can be used to carry out distributed denial-of-service (DDoS) attacks. Using a botnet to perform DDoS attacks can potentially create significant disruptions, such as the 2.4 Tbps DDoS attack Microsoft mitigated<\/a> in August 2021. DDoS attacks in and of themselves can be highly problematic for numerous reasons, but such attacks can also be used as cover to hide further malicious activities, like deploying malware and infiltrating target systems.<\/p>\n

Botnets can also be used to compromise other devices, and XorDdos is known for using Secure Shell (SSH) brute force attacks to gain remote control on target devices. SSH is one of the most common protocols in IT infrastructures and enables encrypted communications over insecure networks for remote system administration purposes, making it an attractive vector for attackers. Once XorDdos identifies valid SSH credentials, it uses root privileges to run a script that downloads and installs XorDdos on the target device.<\/p>\n

XorDdos uses evasion and persistence mechanisms that allow its operations to remain robust and stealthy. Its evasion capabilities include obfuscating the malware\u2019s activities, evading rule-based detection mechanisms and hash-based malicious file lookup, as well as using anti-forensic techniques to break process tree-based analysis. We observed in recent campaigns that XorDdos hides malicious activities from analysis by overwriting sensitive files with a null byte. It also includes various persistence mechanisms to support different Linux distributions. <\/p>\n

\"Figure
Figure 1. A typical attack vector for XorDdos malware<\/figcaption><\/figure>\n

XorDdos may further illustrate another trend observed in various platforms, in which malware is used to deliver other dangerous threats. We found that devices first infected with XorDdos were later infected with additional malware such as the Tsunami backdoor, which further deploys the XMRig coin miner. While we did not observe XorDdos directly installing and distributing secondary payloads like Tsunami, it\u2019s possible that the trojan is leveraged as a vector for follow-on activities.<\/p>\n

Microsoft Defender for Endpoint<\/a> protects against XorDdos by detecting and remediating the trojan\u2019s multi-stage, modular attacks throughout its entire attack chain and any potential follow-on activities on endpoints. In this blog post, we detail our in-depth analysis of XorDdos to help defenders understand its techniques and protect their networks from this stealthy malware.<\/p>\n

This blog post covers the following topics:<\/p>\n