مائیکروسافٹ نے XorDdos میلویئر کی بڑھتی ہوئی سرگرمی سے خبردار کیا ہے۔

ہیلگا اسمتھمئی 24, 2022آخری تازہ کاری: مئی 24, 2022
61 1 منٹ پڑھیں

Microsoft experts have warned that the activity of XorDdos, a modular malware used to hack Linux devices and create a DDoS botnet, has increased by 254% over the past six months.

This malware, also known as XOR.DDoS اور XOR DDoS, has been active since 2014 and targets Linux systems. It got its name due to the use of XOR-based encryption, which is used when exchanging data with control servers, as well as because DDoS attacks that are carried out with its help.

Let me remind you that we also reported that The Appearance of Cheap DarkCrystal RAT Malware Worried Experts.

XorDdos is usually distributed by scanning open SSH and Telnet ports and subsequent brute force attacks. In order to spread to more devices, the malware uses a shell script that tries to log in as root, trying out different passwords for thousands of systems available on the Internet

XorDdos میلویئر سرگرمی
XorDdos attack scheme

According to experts, the success of this botnet is explained mainly due to the use of various evasion tactics and methods of maintaining a stable presence, which allows XorDdos to remain invisible and difficult to remove.

Its capabilities include obfuscation, evasion of rules-based detection and hash-based malware detection mechanisms, and the use of various techniques to disrupt process of the tree-based analysis. While studying recent campaigns, we noticed that XorDdos hides malicious activity from analysis by overwriting sensitive files with a null byte.Microsoft 365 Defender wrote.

The report also notes that in addition to launching DDoS attacks, operators use XorDDoS to install rootkits, maintain access to hacked devices, and likely to deliver additional payloads.

We found that devices originally infected with XorDdos were later infected with additional malware, such as the Tsunami backdoor, which additionally deployed the XMRig miner. Although we have not observed XorDdos directly installing and distributing secondary payloads such as Tsunami, it is possible that the Trojan is being used as a vector for subsequent attacks.the researchers write.
Interestingly, the conclusions of Microsoft experts are consistent with the report of CrowdStrike, which also noted an increase in XorDDoS activity in particular and malware for Linux in general: in 2021, there was a 35% increase in such malware. Analysts generally concluded that XorDDoS, Mirai, اور Mozi are the most common malware families, accounting for 22% of all attacks on Linux devices in 2021.
ٹیگز
ہیلگا اسمتھمئی 24, 2022آخری تازہ کاری: مئی 24, 2022
61 1 منٹ پڑھیں

ہیلگا اسمتھ

مجھے ہمیشہ کمپیوٹر سائنسز میں دلچسپی تھی۔, خاص طور پر ڈیٹا سیکیورٹی اور تھیم, جسے آج کل کہا جاتا ہے۔ "ڈیٹا سائنس", میری ابتدائی نوعمری سے. ایڈیٹر ان چیف کے طور پر وائرس ہٹانے والی ٹیم میں آنے سے پہلے, میں نے کئی کمپنیوں میں سائبر سیکیورٹی کے ماہر کے طور پر کام کیا۔, ایمیزون کے ٹھیکیداروں میں سے ایک سمیت. ایک اور تجربہ: مجھے آرڈن اور ریڈنگ یونیورسٹیوں میں پڑھانا ملا ہے۔.

جواب چھوڑیں

یہ سائٹ سپیم کو کم کرنے کے لیے Akismet کا استعمال کرتی ہے۔. جانیں کہ آپ کے تبصرے کے ڈیٹا پر کیسے کارروائی کی جاتی ہے۔.

واپس اوپر کے بٹن پر