{"id":91919,"date":"2020-08-20T13:41:55","date_gmt":"2020-08-20T11:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet"},"modified":"2020-08-20T13:41:55","modified_gmt":"2020-08-20T11:41:55","slug":"vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet","title":{"rendered":"The FritzFrog worm has been detected, targeting servers via SSH and building a decentralized botnet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Guardicore, a company specializing in data center and cloud system protection, has identified<\/a><\/noindex> has identified a new high-tech malware named FritzFrog, which targets Linux-based servers. FritzFrog combines a worm that spreads through brute-force attacks on servers with open SSH ports and components for building a decentralized botnet that operates without control nodes and lacks a single point of failure.<\/p>\n

The botnet is built using a proprietary P2P protocol, allowing nodes to interact with each other, coordinate attack organization, maintain network operation, and monitor each other's status. New victims are identified through brute-force attacks on servers that accept SSH requests. When a new server is detected, it undergoes a dictionary attack using common username and password combinations. Management can be conducted through any node, complicating the detection and blocking of botnet operators.<\/p>\n

According to researchers, the botnet already comprises about 500 nodes, including servers from several universities and a large railway company. It is noted that the primary targets of the attacks are networks of educational institutions, medical centers, government agencies, banks, and telecommunications companies. After compromising a server, a process for mining the cryptocurrency Monero is initiated. The activity of the observed malware has been tracked since January 2020.<\/p>\n

A distinctive feature of FritzFrog is that it keeps all data and executable code solely in memory. Changes to the disk are limited to adding a new SSH key to the authorized_keys file, which is later used for access to the server. System files remain unchanged, making the worm undetectable by systems checking integrity via checksums. In memory, it also retains dictionaries for password brute-forcing and mining data, which are synchronized among nodes using the P2P protocol.<\/p>\n

Malicious components disguise themselves as processes like , , , and . Botnet nodes monitor the status of their neighbors and, in the event of a server reboot or even a complete OS reinstall (if a modified authorized_keys file was transferred to the new system), reactivate the malicious components on the host. The standard SSH is used for communication\u2014 the malware additionally launches a local , binding to the localhost interface and listening for traffic on port 1234, which external nodes access via an SSH tunnel using the key from authorized_keys.
\n

\"The<\/a><\/noindex><\/center><\/p>\n

The code for FritzFrog components is written in Go and operates in multithreaded mode. The malware includes several modules run in different threads:<\/p>\n