A sophisticated network of 25,000 compromised Linux servers has become the foundation of a massive cyber-criminal botnet capable of sending 35 million spam messages and redirecting more than 500,000 Web visitors to exploit kits every day, according to a report published by software security firm ESET.
A collection of malware, dubbed Windigo by ESET, forms the basis for the cyber-criminal infrastructure. A Linux backdoor, known as Linux/Ebury, steals credentials to infect other servers, while another backdoor, known as Linux/Cdorked, compromises Web servers and redirects traffic.
The collection of programs has created an impressively sophisticated network that can distribute spam, redirect Web traffic and infect users’ computers with malware, while hiding the location of the criminals behind the attacks, ESET Security Researcher Olivier Bilodeau told eWEEK.
“The whole thing is really well put together,” he said. “When we were trying to find who is behind the operation, we found it very difficult.”
The investigation into the first of the malware components began in September 2011, after an attack against the Linux Foundation that compromised more than 400 users of kernel.org, the report stated. Researchers from ESET, the Swiss computer emergency response team CERT-Bund, the Swedish National Infrastructure for Computing, and the European Organization for Nuclear Research (CERN) teamed with other organizations to create a working group to study the malware.
As the group widened its investigation, it discovered that an increasing number of Web sites had been infected, growing from an estimated 11,000 servers in February 2013 to more than 26,000 this month. While the numbers of infected systems is much lower than other botnets created from compromised consumer PCs, infected servers are much more powerful tools than the average home-based computer, Bilodeau said.
The cyber-criminals are not using the systems for denial-of-service attacks, a popular strategy in past server attacks, he said.
“They are using the botnet for spam advertisement, and for making money,” Bilodeau said. “We have not seen cases of malware sent as spam, even though we really expected to see some.”
Unlike many attacks, which attempt to exploit vulnerabilities in the software running the sites, Linux/Ebury collects secure shell (SSH) user credentials, which allow system administrators to easily connect to other servers that they manage. The credentials are stolen when a user logs into an infected server or a user on a compromised server logs into another system.
Web servers infected with Linux/Cdorked are used to redirect visitors to malware download sites hidden by a complex web of proxy servers. The victim will eventually reach a download server, which will attempt to exploit the user.
The working group tied the pieces of the malware puzzle together based on common infrastructure and shared code, according to the report. ESET published the report on Linux/Ebury and the other components with the goal of allowing security professionals to use the information to better defend their networks against the attackers, the report stated.