The malware, functioning as a backdoor and credential stealer allows attackers to deploy additional payloads, such as HelimodSteal, HelimodRedirect, and HelimodProxy, expanding their presence within compromised networks. Ebury has evolved over the years with the latest version, 1.8.2, introducing new obfuscation techniques, a domain generation algorithm (DGA), and a userland rootkit to better conceal its presence. These tools are primarily aimed at monetizing compromised servers through various means including credit card information theft, cryptocurrency stealing, traffic redirection, spam sending, and credential stealing.

Ebury's associated Apache HTTP server modules—HelimodSteal, HelimodRedirect, and HelimodProxy—are used to intercept HTTP POST requests, redirect traffic to ads, and proxy spam traffic. A kernel module called KernelRedirect modifies HTTP traffic to perform redirection. Attackers also employ software to hide malicious traffic and Perl scripts to carry out large-scale AitM attacks within hosting providers' data centers, targeting valuable servers to steal cryptocurrency from wallets. Between February 2022 and May 2023, as many as 200 servers across more than 75 networks in 34 countries were compromised in this manner.

Furthermore, Ebury facilitates server-side web skimming by capturing credit card data submitted to online stores via infected servers. Tools like Ebury and FrizzySteal, a malicious shared library injected into libcurl, can exfiltrate requests to external servers, bypassing end-to-end encryption (HTTPS).

The malware leverages access to servers used for shared hosting to capture unencrypted web traffic for stealthy redirection or extract sensitive details submitted in online forms. This comprehensive and multifaceted approach underscores the extensive capabilities and significant threat posed by the Ebury botnet to global cybersecurity.

Impact

• Financial Loss
• Unauthorized Access
• Credential Theft
• Identity Theft

Indicators of Compromise

SHA1

• a6707c7ef12ce9b0f7152ca300ebb2bc026ce0b
• ac96adbe1b4e73c95c28d87fa46dcf55d4f8eea2
• b58725399531d38ca11d8651213b4483130c98e2
• 09c8af3be4327c83d4a7124a678bbc81e12a1de4
• 2fc132440bafdbc72f4d4e8dcb2563cc0a6e096b
• dd7846b3ec2e88083cae353c02c559e79124a745
• 9018377c0190392cc95631170efb7d688c4fd393
• 03592b8147e2c84233da47f6e957acd192b3796a
• 858c612fe020fd5089a05a3ec24a6577cbeaf7eb

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Passwords – Ensure that general security policies are employed including implementing strong passwords, correct configurations, and proper administration security policies.
• Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.