SOCRadar® Cyber Intelligence Inc. | Latest DDoS Threats: Condi Botnet, ShellBot, and Tsunami Malware

Home

Resources

Blog

Jun 21, 2023

6 Mins Read

Latest DDoS Threats: Condi Botnet, ShellBot, and Tsunami Malware

Notable Distributed-Denial-of-Service (DDoS) incidents dominate the cyber threat landscape this week, now accompanied by the reappearance of specific DDoS malware and the emergence of a relatively fresh peril.

This blog explores the rising number of Condi malware samples targeting TP-Link routers, along with the recent discovery of Linux servers being compromised for the distribution of Tsunami and ShellBot.

Condi Malware Targets TP-Link Routers to Expand Its Botnet

Researchers have observed that Condi, a new distributed DDoS malware, exploits a security vulnerability in TP-Link routers to recruit devices into a powerful DDoS botnet.

The Condi malware targets TP-Link Archer AX21 (AX1800) Wi-Fi routers and attempts to spread using a critical command injection vulnerability, tracked as CVE-2023-1389 (CVSS score: 8.8), disclosed in March 2023.

Fortinet FortiGuard Labs has noticed a surge in Condi samples since late May 2023, implying that threat actors are actively working on expanding the botnet.

Who Is the Threat Actor Behind Condi Botnet?

Researchers discovered a Command and Control (C2) domain (admin[.]duc3k[.]com) that previously displayed the message “contact @zxcr9999 telegram,” leading them to the threat actor’s Telegram channel.

The threat actor zxcr9999 has been managing the Telegram channel “Condi Network” for advertising purposes since May 2022. They also profit from their botnet army by offering DDoS-as-a-Service and selling the malware’s source code.

*Threat actor advertises Condi DDoS malware on Telegram*

How Does the Condi Malware Infect Devices?

Fortinet researchers have conducted an analysis of the Condi malware and discovered that it targets specific processes and filenames to terminate them. Condi is unable to persist through a system reboot, a characteristic commonly observed in Mirai-based botnets, as highlighted by the researchers. Therefore, the malware takes this step to improve its survivability.

The malware can terminate other botnets on the same host and delete specific binaries responsible for system rebooting or shutdown. The Condi malware furthermore aims to kill older versions of it running on infected devices, but the implementation is flawed as it only considers the executable names and not their full paths.

Condi differs from other botnets that rely on brute-force attacks for distribution. It utilizes a scanner module, which targets the routers susceptible to CVE-2023-1389. The scanner searches for vulnerable TP-Link Archer AX21 devices and executes a shell script retrieved from a C2 server to deploy the malware upon discovery.

Fortinet has identified additional Condi samples that leverage different security vulnerabilities to distribute the malware, highlighting how unpatched software products will remain vulnerable.

See indicators of compromise related to Condi malware at the end of the blog. For more information, visit Fortinet’s blog.

Tsunami and ShellBot DDoS Malware Target Linux Devices for Cryptomining Operations

Researchers have discovered that attackers are breaching Linux servers to distribute DDoS bots Tsunami (aka Kaiten) and ShellBot, while also utilizing the servers for cryptocurrency mining operations.

According to researchers from AhnLabs, the source code of Tsunami is publicly accessible, and numerous threat actors use it in attacks against IoT devices and Linux servers, covertly exploiting their resources.

How Do Attackers Utilize Tsunami and ShellBot In Attacks?

The attackers start by compromising servers through a dictionary attack, enabling the execution of a malicious shell script. The shell script can download malware and establish persistent backdoor access by adding a public key to the “.ssh/authorized_keys” file.

The attackers scan external ports to locate exposed Linux SSH servers. With the aid of known account credentials, they conduct dictionary attacks to gain access to poorly managed servers and execute commands to install various malware. Among these malicious components is a downloader-type Bash script named the “key” file, responsible for installing additional malware, including the ShellBot malware, which presents itself as “bot” and “logo” in the command.

The specific malware employed in these attacks is a new variant of the Tsunami botnet called Ziggy. Ziggy bears notable similarities to the original source code and employs the Internet Relay Chat (IRC)protocol for C2 operations. This protocol facilitates real-time text messaging between internet-connected computers.

Once installed, the IRC bot on the compromised system connects to a designated channel controlled by the threat actor. It either transmits stolen information to the channel or awaits malicious commands.

Researchers have observed that the attackers install some additional malware, including Log Cleaner, a privilege escalation malware, and XMRig CoinMiner, to assist their malicious actions and also cover the tracks. For further information, see AhnSec’s analysis of the malware.

To prevent exploitation, researchers advise administrators to use stronger passwords and change them on a regular basis, and stay up to date with the latest patches.

How Can SOCRadar Help?

Stay one step ahead of malicious actors and protect your digital assets with SOCRadar. Our platform continuously tracks the behavior of threat actors and monitors the latest malware, providing you with real-time information and indicators of compromise. By staying informed about potential risks, you can take proactive measures to detect and eliminate threats before they can cause significant harm to your organization.

Enhance your organization’s defense against Denial-of-Service (DoS) threats with SOCRadar Labs’ DoS Resilience module. DoS Resilience allows you to test your domain’s or subnet’s ability to resist DoS attacks.