FritzFrog botnet is active again

The P2P botnet FritzFrog, which was discovered by researchers back in 2020 and then ceased operations, is active again, and its attacks have become much more intense.

Let me remind you that in 2020, the botnet was noticed by experts from Guardicore Labs (now a division of Akamai). Then it actively attacked SSH servers belonging to government, educational, financial, medical and telecommunications organizations and institutions around the world, and well-known universities in the US and Europe, as well as a railway company, suffered from these hacks.

In 2020, the main goal of FritzFrog was to mine the Monero cryptocurrency. For doing this, on the infected systems XMRig miner was deployed. It was also connected to the connected to the web.xmrpool.eu pool via port 5555 was deployd. in orice caz, by the end of the year, the activity of the botnet completely ceased for unknown reasons.

As Akamai analysts now report, in December 2021, FritzFrog returned with improved code, and its attacks became much more intense. The botnet still bruteforces SSH to infect new systems and still uses a P2P architecture to control infected hosts. Among the changes found in the code, analysts note:

  1. adding support for Tor-proxy to mask brute-force attacks;
  2. using the SCP protocol to copy itself into compromised systems;
  3. The appearance of a blacklist that includes servers that cannot be infected (mostly low-cost systems with limited resources: Raspberry Pi devices or low-resource EC2 images on AWS);
  4. preparation of a botnet for attacks on WordPress sites.

As before, after being hacked, the attackers use the obtained access to mine the Monero cryptocurrency. Akamai reports that it is already recording about 500 incidents per day, and in total, the botnet has infected more than 1,500 systems.

Approximately 37% of infected machines are located in China, but companies and organizations around the world become victims of FritzFrog, which is why analysts believe that botnet attacks are random, that is, hackers do not carefully select their future victims.

[The attacks are] targeting server machines belonging to organizations of various sizes and from various sectors, including healthcare, education, and government agencies. We have found infected machines in the network of European TV channels, at a Russian manufacturer of medical equipment and at several universities in East Asia.the company said.

Let me remind you that we also reported that MyKings botnet steals cryptocurrency via clipboard, și de asemenea că Pink botnet was infected over 1.5 million devices.

Helga Smith

Am fost mereu interesat de informatică, în special securitatea datelor și tema, care se numește în zilele noastre "știința datelor", încă din prima adolescență. Înainte de a intra în echipa de eliminare a virușilor în calitate de redactor-șef, Am lucrat ca expert în securitate cibernetică în mai multe companii, inclusiv unul dintre contractorii Amazon. O altă experiență: Am predat în universitățile Arden și Reading.

lasa un raspuns

Acest site folosește Akismet pentru a reduce spamul. Aflați cum sunt procesate datele comentariilor dvs.

Butonul înapoi la început