According to the most recent attack chains, next-stage payloads are deployed by brute-forcing SSH servers with weak passwords to enable a cryptocurrency mining attack using "systemd-net," but not before rival malware that was previously operating on the compromised host is eliminated. Additionally, it launches a worming module called ld-musl-x86, a Go-based SSH scanner that spreads malware to other systems and searches the internet for weakly secured servers. The researchers said that this effectively increases the botnet's size. This includes SSH, Telnet, and credentials for cloud systems such as AWS, Azure, and Hadoop, as well as game servers.

The cryptocurrency miner in use is called XMRig, and it mines Monero. But in this instance, the threat actor wants to use the --opencl and --cuda settings to build a cryptominer that makes use of the computing capacity of the GPU and NVidia GPU. This, together with the fact that the threat actor is primarily affecting cryptocurrency mining as opposed to DDoS attacks, bolsters the assertion that this variant is distinct from earlier ones. Cloud-native environments with powerful CPU and GPU capabilities are the target audience. There are more than 30 million publicly accessible SSH servers. Consequently, users must take precautions to safeguard the instances from brute-force attacks and possible exploitation.

Impact

• Cryptocurrency Theft
• Denial of Service
• Operational Disruption

Remediation

• Never trust or open links and attachments received from unknown sources/senders.
• Upgrade your operating system.
• Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.
• Immediately change default passwords on IoT devices to unique ones.
• Keep devices' firmware and software up to date to ensure that known vulnerabilities are patched.
• Implement firewalls and intrusion detection systems to monitor and control traffic to and from IoT devices.
• Employ tools that can identify unusual behavior or traffic patterns that might indicate a DDoS attack or a compromised device.
• Disable any unnecessary services or features on IoT devices to reduce their attack surface.
• Follow security best practices, such as disabling remote management if not needed and enabling security features provided by the device manufacturer.
• Deploy intrusion detection and prevention systems (IDS/IPS) to monitor for anomalous or malicious network activity.
• Set up alerts for unusual traffic patterns that might indicate a DDoS attack or a compromised device.