Guardicore, a company specializing in data center and cloud system protection, has identified a new high-tech malware named FritzFrog, which targets Linux-based servers. FritzFrog combines a worm that spreads through brute-force attacks on servers with open SSH ports and components for building a decentralized botnet that operates without control nodes and lacks a single point of failure.
The botnet is built using a proprietary P2P protocol, allowing nodes to interact with each other, coordinate attack organization, maintain network operation, and monitor each other's status. New victims are identified through brute-force attacks on servers that accept SSH requests. When a new server is detected, it undergoes a dictionary attack using common username and password combinations. Management can be conducted through any node, complicating the detection and blocking of botnet operators.
According to researchers, the botnet already comprises about 500 nodes, including servers from several universities and a large railway company. It is noted that the primary targets of the attacks are networks of educational institutions, medical centers, government agencies, banks, and telecommunications companies. After compromising a server, a process for mining the cryptocurrency Monero is initiated. The activity of the observed malware has been tracked since January 2020.
A distinctive feature of FritzFrog is that it keeps all data and executable code solely in memory. Changes to the disk are limited to adding a new SSH key to the authorized_keys file, which is later used for access to the server. System files remain unchanged, making the worm undetectable by systems checking integrity via checksums. In memory, it also retains dictionaries for password brute-forcing and mining data, which are synchronized among nodes using the P2P protocol.
Malicious components camouflage themselves as processes like "ifconfig", "libexec", "php-fpm", and "nginx". Botnet nodes monitor the status of peers, and in the event of a server reboot or even a reinstallation of the OS (if a modified authorized_keys file was transferred to the new system), they reactivate the malicious components on the host. Communication is done via standard SSH—malware additionally launches a local "netcat" that binds to the localhost interface and listens for traffic on port 1234, which external nodes access through an SSH tunnel, using the key from authorized_keys for connection.
The code for FritzFrog components is written in Go and operates in multithreaded mode. The malware includes several modules run in different threads:
- Cracker — performs password guessing on the targeted servers.
- CryptoComm + Parser — establishes an encrypted P2P connection.
- CastVotes — a mechanism for collaboratively selecting target hosts for attack.
- TargetFeed — retrieves a list of nodes to attack from neighboring nodes.
- DeployMgmt — the implementation of a worm that spreads malicious code to the compromised server.
- Owned — responsible for connecting to servers where the malicious code is already running.
- Assemble — reconstructs the file in memory from separately transmitted blocks.
- Antivir — a module that suppresses competing malware, identifies and terminates processes with the string "xmr" that consume CPU resources.
- Libexec — a module for mining the cryptocurrency Monero.
The P2P protocol used in FritzFrog supports around 30 commands responsible for data transfer between nodes, script execution, malware component transmission, status polling, log exchange, proxy launching, and so on. Information is sent over a separate encrypted channel serialized in JSON format. The asymmetric cipher AES is used for encryption and Base64 for encoding. The DH protocol () is employed for key exchange. To determine the state, nodes constantly exchange ping requests.
All botnet nodes support a distributed database containing information about targeted and compromised systems. Attack targets are synchronized across the botnet — each node attacks a separate target, meaning that two different botnet nodes will not attack the same host. Nodes also collect and share local statistics with neighbors, such as free memory size, uptime, CPU load, and SSH login activity. This information is used to decide whether to start the mining process or to use the node solely for attacking other systems (for instance, mining is not initiated on heavily loaded systems or systems with frequent administrator access).
To identify FritzFrog, researchers have proposed a simple method for determining system compromise
based on signs such as having a listening connection on port 1234, presence of in authorized_keys (the same SSH key is deployed on all nodes) and the presence in memory of running processes like 'ifconfig', 'libexec', 'php-fpm', and 'nginx', which have no associated executable files ('/proc//exe' points to a remote file). The presence of traffic on network port 5555, occurring when the malware accesses the typical pool web.xmrpool.eu during Monero cryptocurrency mining, can also be an indicator.
Source: opennet.ru
