Linux malware sees 35% growth during 2021

The number of malware infections targeting Linux devices rose by 35% in 2021, most commonly to recruit IoT devices for DDoS (distributed denial of service) attacks.

IoTs are typically under-powered “smart” devices running various Linux distributions and are limited to specific functionality. However, when their resources are combined into large groups, they can deliver massive DDoS attacks to even well-protected infrastructure.

Besides DDoS, Linux IoT devices are recruited to mine cryptocurrency, facilitate spam mail campaigns, serve as relays, act as command and control servers, or even act as entry points into corporate networks.

A Crowdstrike report looking into the attack data from 2021 summarizes the following:

• In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020.
• XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021.
• Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one.
• XorDDoS also had a notable year-over-year increase of 123%.

Malware overview

XorDDoS is a versatile Linux trojan that works in multiple Linux system architectures, from ARM (IoT) to x64 (servers). It uses XOR encryption for C2 communications, hence the name.

When attacking IoT devices, XorDDoS brute-forces vulnerable devices via SSH. On Linux machines, it uses port 2375 to gain password-less root access to the host.

A notable case of the malware’s distribution was shown in 2021 after a Chinese threat actor known as “Winnti” was observed deploying it with other derivative botnets.

Mozi is a P2P botnet relying on the distributed hash table (DHT) lookup system to hide suspicious C2 communications from network traffic monitoring solutions.

The particular botnet has been around for a while, continually adding more vulnerabilities and expanding its targeting scope.

Mirai is a notorious botnet that spawned numerous forks due to its publicly available source code that continues to plague the IoT world.

The various derivatives implement different…