The EnemyBot Malware: Check your Routers, Web Servers, Switches and Other Network Devices from being a victim of the new DDoS Botnet Targets

A group of researchers have recently identified EnemyBot, a brand new Linux-based botnet. At its first look the DDoS based Botnet is seen to causing infection across a large range of devices and platforms. The initial infection was seen to be making a drive-by attempt to /shell at a web server with an interesting payload attached to the “value” string. The researchers alos saw several attempts to download an “update.sh” file using different methods: wget, busybox, and curl. 

The Responsible Attacker Group “Keksec”

The botnet appears to be the work of “Keksec”, who are a group of Cyber-Criminals with expertise in DDoS attacks and cryptocurrency mining. The “Keksec” is tagged to over 400 samples of Malware. The group Keksec (also known as Nero and Freakout) is using the fast-evolving Enemybot to target routers from vendors like Seowon Intech and D-Link and is exploiting a remote code execution (RCE) vulnerability (CVE-2022-27226) discovered last month in iRZ mobile routers. The Malware of the Group, ‘Enemybot’, is also said to be impacting the devises of brand Fortinet. This group is also known for deploying Distributed Denial-of-Service (DDoS) and cryptomining attacks especially targeting Linux-based Gafgyt source among others.

The “Enemybot” Malware

Enemybot, like most botnets, infects multiple architectures to improve the chances of infecting devices and, also among IoT devices, this malware has been designed to target desktop and server architectures like BSD, macOS, Arm and x86. The Malware is also using a range of obfuscation methods to make it more difficult for the malware to be analyzed and to hide it from other botnets. In addition, it connects to a Command-and-Control (C2) server hidden in the Tor network, which increases its anonymity and makes it harder to take it down. Once a device is compromised, Enemybot drops a file in /tmp/.pwned that contains a message pointing to ‘Keksec’ as the attacker. There are many more iterations to the different variants of the attack vector that has been noticed in the recent pattern.

“This mix of exploits targeting web servers and applications beyond the usual IoT devices, coupled with the wide range of supported architectures, might be a sign of Keksec testing the viability of expanding the botnet beyond low-resource IoT devices for more than just DDoS attacks. Based on their previous botnet operations, using them for cryptomining is a big possibility,” said Fortinet that is reporting on the malware.

The Way Forward

The EnemyBot malware appears to follow similar structures and patterns we’ve seen with other common botnets, with a few changes. There appears to be strong correlation to that of the LolFMe botnet which contains other similar strings such as “watudoinglookingatdis”. The LolFMe botnet was quite short-lived and was never popular so it will be interesting to see how far off the ground this particular strain will take the IT Users to. The malware has been noticed to have been built using the source code of the Gafgyt (Bashlite) botnet – which leaked in 2015 – with some modules borrowed from the infamous Mirai botnet, including the scanner module and a bot killer module.

Both LolFMe and Mirai botnets leverage multi-architecture support and RCE as the initial foothold. This was also the case for EnemyBot.

Mitigation Recommendations

Securonix Company (https://www.securonix.com/) has suggested a few Mitigation Remediation:

Some possible actions are recommended that can potentially help proactively mitigate the impact of the EnemyBot attacks on your network. 

• Ensure systems are fully patched and not vulnerable to RCE

• Patch IoT devices’ firmware to the latest versions to mitigate external exploitation

• Employ the usage of layer-7 network monitoring and detection to detect common exploits that may leverage RCE

• Ensure that externally exposed network segments are isolated from internal hosts

• Disable or limit execution from linux /tmp/ directories

IP Communication observed: 198.12.116.254

Detection and Indicators of Compromise (IoCs):