Microsoft has issued a warning about a new cryptomining assault targeting Linux computers and IoT devices, which is allegedly being deployed by asterzeu, who is already selling the toolkit on the malware-as-a-service market.
The attackers employ a backdoor to gain control of the devices and steal resources for cryptocurrency mining. They also install a customized version of OpenSSH, which allows them to hijack SSH credentials, roam about the network, and conceal their harmful activity.
To start the attack, they exploit weakly protected Linux hosts and then replace OpenSSH with a compromised version. This backdoor enables the attackers to deliver more harmful software and carry out further unauthorized actions like exfiltrating information about the device, installing open-source rootkits called Diamorphine and Reptile from GitHub, and taking steps to obscure its activity by clearing logs that could alert its presence.
The implant takes control of the infected system’s resources and stops any competing crypto mining processes. It also runs a modified version of ZiggyStarTux, a DDoS client that can execute commands from a command-and-control server. This modified version is based on a botnet malware called Kaiten.
The sources for this piece include an article in TheHackerNews.