Description
A recently discovered evasive malware forces the Secure Shell (SSH) cryptographic protocol to enter targeted systems with the goal of carrying out distributed denial-of-service (DDoS) attacks and mining cryptocurrency.
Summary
The Golang-based virus, known as KmsdBot has been discovered to attack a range of businesses, including gambling, luxury vehicle brands, and security agencies.
According to researchers, the botnet infects systems via an SSH connection that leverages weak login credentials. As a means of avoiding discovery, the malware does not stay persistent on the infected system.
An application with the name “kmsd.exe” that is downloaded from a remote server after a successful penetration gives the malware its name. Additionally, it is made to support a variety of architectures, including Winx86, Arm64, MIPS, and x86 64.
By downloading a list of login and password combinations, KmsdBot may undertake scanning activities and spread itself. Additionally, it can update the malware and manage the mining process.
Remediation
The following are some recommendations to keep systems and networks secure:
For servers or installed programs, avoid using weak or default credentials.
Make sure you regularly check on those deployed applications and keep them updated with the most recent security fixes.
To secure your SSH connections, use public key authentication. This is the easiest approach to stop this kind of system compromise.
The Guyana National CIRT recommends that users and administrators review this alert and apply it where necessary.
PDF Download: KmsdBot Malware Hijacking Systems.pdf
References
Cashdollar, L. (2022, November 10). KmsdBot: The Attack and Mine Malware. Reviewed from Akamai Security Research:
https://www.akamai.com/blog/security-research/kmdsbot-the-attack-and-mine-malware
Lakshmanan, R (2022, November 14). New KmsdBot Malware Hijacking Systems for Mining Crypto and Launch DDoS Attacks. Reviewed from HackerNews:
https://thehackernews.com/2022/11/new-kmsdbot-malware-hijacking-systems.html