{"id":20822,"date":"2022-12-15T10:02:45","date_gmt":"2022-12-15T18:02:45","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/12\/15\/news-14555\/"},"modified":"2022-12-15T10:02:45","modified_gmt":"2022-12-15T18:02:45","slug":"news-14555","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/12\/15\/news-14555\/","title":{"rendered":"MCCrash: Cross-platform DDoS botnet targets private Minecraft servers"},"content":{"rendered":"

Credit to Author: Paul Oliveria| Date: Thu, 15 Dec 2022 18:00:00 +0000<\/strong><\/p>\n

Malware operations continue to rapidly evolve as threat actors add new capabilities to existing botnets, increasingly targeting and recruiting new types of devices. Attackers update malware to target additional operating systems, ranging from PCs to IoT devices, growing their infrastructure rapidly. The Microsoft Defender for IoT research team recently analyzed a cross-platform botnet that originates from malicious software downloads on Windows devices and succeeds in propagating to a variety of Linux-based devices.<\/p>\n

The botnet spreads by enumerating default credentials on internet-exposed Secure Shell (SSH)-enabled devices. Because IoT devices are commonly enabled for remote configuration with potentially insecure settings, these devices could be at risk to attacks like this botnet. The botnet\u2019s spreading mechanism makes it a unique threat, because while the malware can be removed from the infected source PC, it could persist on unmanaged IoT devices in the network and continue to operate as part of the botnet.<\/p>\n

Microsoft tracks this cluster of activity as DEV-1028, a cross-platform botnet that infects Windows devices, Linux devices, and IoT devices. The DEV-1028 botnet is known to launch distributed denial of service (DDoS) attacks against private Minecraft servers.<\/p>\n

Our analysis of the DDoS botnet revealed functionalities specifically designed to target private Minecraft Java servers using crafted packets, most likely as a service sold on forums or darknet sites. A breakdown of the systems affected by the botnet over the three months from the time of this analysis also revealed that most of the devices were in Russia:<\/p>\n

\"A
Figure 1. IP distribution of devices infected by the botnet<\/figcaption><\/figure>\n

This type of threat stresses the importance of ensuring that organizations manage, keep up to date, and monitor not just traditional endpoints but also IoT devices that are often less secure. In this blog post, we share details on how this botnet affects multiple platforms, its DDoS capabilities, and recommendations for organizations to prevent their devices from becoming part of a botnet. We also share Minecraft server version information for owners of private servers to update and ensure they are protected from this threat.<\/p>\n

Cross-platform botnet targets SSH-enabled devices<\/h2>\n

Microsoft researchers observed that the initial infection points related to the botnet were devices infected through the installation of malicious cracking tools that purport to acquire illegal Windows licenses.<\/p>\n

\"Two
Figure 2. Cracking tools used to spread the botnet.<\/figcaption><\/figure>\n

The cracking tools contain additional code that downloads and launches a fake version of svchost.exe <\/em>through a PowerShell command. In some cases, the downloaded file is named svchosts.exe<\/em>.<\/p>\n

\"A
Figure 3. The code of the .NET executable that downloads and runs svchost.exe<\/figcaption><\/figure>\n

Next, svchost.exe<\/em> launches malicious.py<\/em>, the main Python script that contains all the logic of the botnet, whichthen scans the internet for SSH-enabled Linux-based devices (Debian, Ubuntu, CentOS, and IoT workloads such as Raspbian, which are commonly enabled for remote configuration) and launches a dictionary attack to propagate. Once a device is found, it downloads the file Updater.zip<\/em> from repo[.]ark\u2014event[.]net<\/em> onto the device, which creates the file fuse. <\/em>The fuse<\/em> file then downloads a copy of malicious.py<\/em> onto the device. Both svchost.exe<\/em> and fuse<\/em> are compiled using PyInstaller, which bundles all the Python runtime and libraries necessary to initiate malicious.py<\/em>.<\/p>\n

\"A
Figure 4. The DDoS botnet attack flow<\/figcaption><\/figure>\n

While malicious.py<\/em> has specific functionalities depending on whether the file launches on a Windows or Linux-based device (for Windows, the file establishes persistency by adding the registry key SoftwareMicrosoftWindowsCurrentVersionRun<\/em> with the executable as the value), the executable is compiled to operate on both Windows and Linux-based devices. The file communicates with its command-and-control (C2) server to launch the following commands:<\/p>\n