Tag Archive for: DreamBus

DreamBus botnet targets enterprise apps running on Linux servers

/in


dreambus.png

Image: Zscaler

Chances are that if you deploy a Linux server online these days and you leave even the tiniest weakness exposed, a cybercrime group will ensnare it as part of its botnet.

The latest of these threats is named DreamBus.

Analyzed in a report published last week by security firm Zscaler, the company said this new threat is a variant of an older botnet named SystemdMiner, first seen in early 2019.

But current DreamBus versions have received several improvements compared to initial SystemdMiner sightings [1, 2, 3].

Currently, the botnet targets enterprise-level apps that run on Linux systems. Targets include a wide collection of apps, such as PostgreSQL, Redis, Hadoop YARN, Apache Spark, HashiCorp Consul, SaltStack, and the SSH service.

Some of these apps are targeted with brute-force attacks against their default administrator usernames, others with malicious commands sent to exposed API endpoints, or via exploits for older vulnerabilities.

The idea is to give the DreamBus gang a foothold on a Linux server where they could later download and install an open-source app that mines the Monero (XMR) cryptocurrency to generate profits for the attackers.

Furthermore, each of the infected servers is also used as a bot in the DreamBus operation to launch further brute-force attacks against other possible targets.

Zscaler also said that DreamBus employed quite a few measures to prevent easy detection. One of them was that all systems infected with the malware communicated with the botnet’s command and control (C&C) server via the new DNS-over-HTTPS (DoH) protocol. DoH-capable malware is very rare, as it’s complex to set up.

…

Source…

DreamBus Botnet Targets Linux Systems

/in


Cryptocurrency Fraud
,
Cybercrime
,
Fraud Management & Cybercrime

Researchers Say It Hijacks Powerful Computer Systems to Mine Monero

Prajeet Nair (@prajeetspeaks) •
January 22, 2021    

DreamBus Botnet Targets Linux Systems
A diagram of the DreamBus botnet architecture (Source: Zscaler)

Zscaler’s ThreatLabz research team is tracking a new botnet dubbed DreamBus that’s installing the XMRig cryptominer on powerful enterprise-class Linux and Unix systems with the goal of using their computing power to mine monero.

See Also: Buyer’s Guide Report: Choosing the Right Security Testing Solution


DreamBus presents a serious threat because of the many components it uses to spread via the internet and the wormlike behavior that enables it to move laterally once inside a targeted system, ThreatLabz says. Many of the bot’s components have previously been detected, some as far back as 2018, the report states.

Based on the time stamps associated with the deployment of new commands, Zscaler believes the attackers are located in Russia or Eastern Europe. Zscaler does not know how many organizations have been hit.

Attack Route

DreamBus, which is based on a series of executable and linkable format binaries and Unix shell scripts, uses a number of methods to identify victims. These include using different modules to search for targets with weak passwords or remote code execution vulnerabilities in popular enterprise applications, such as Secure Shell, as well as IT administration tools, cloud-based applications and databases,…

Source…