گسترش تاکتیک‌ها از Cryptojacking تا حملات DDoS با استفاده از بات‌نت توسط Diicot

?? ????? ??????? ?????? ????  ???? ????? ?????? ????? ?????? payload??? ???????? ???? ????? ?? ?? ????? ????????? ?? ??? Diicot ?? ??? ???????? ?? ??????? ?? ?? ???? ?????????? ????? ????? ????? (DDoS) ???? ??????.

Cado Security ?? ?? ????? ??? ?? ??? ???? ???[?]: «??? Diicot ??? ???? ???? ??? ??? ?????? ??? ???? ???? ?????? ?? ??????? ? ?????? ???????????? ??????[?] ???. ????? ?? ???? ???? ??????????? ?? ????????? ??? ???? ???? ??????? ? ?????? ????? ?? ??? ?????? ???.»

Diicot (?? ??? ?????? Mexals) ????????? ???? Bitdefender ?? ????? ???? ????? ??[?] ? ???? ??? ?? ????? ?? ?? ????? brute-forcer SSH ????? ?? Go ?? ??? Diicot Brute ???? ???? ?? ?????????? ?????? ???????? ???? ?? ?? ????? cryptojacking ??????? ??????.

??? ?? ????? ??? ?????? Akamai ???? ?? ?? ???????? «????? ????» ?????? ??? ???? ????? ??????? ???? ???[?] ?? ???? ?????? ?? ????? ???? ???? ??? ???? ? ???? ????? ???? ??? ????????? ???? ??? ????? ?? ????? ????? ????.

Stiv Kupchik? ???? Akamai ?? ?? ???? ???[?]: ??????? ?? ?? ?????? ?????? ?? ????????? ??????? ??????? ?? ?? ????? ?? cryptominer Monero ?? ??? ????. “?????????? ???? ???? ??????? ?? ?? ????? worm ?????? ????? ???? (SSH)? ?????? ?????????? ????????? ???? payload ? ?? ????? ???? ????????? LAN ???.”

????? ???????????? Cado Security ???? ?????? ?? ??? ???? ?????? ?? ??? ??????? ?? ??? ?? off-the-shelf ?? ??? [?]Cayosin ???? ?? ??????? ??????? ?? ????????? ?????? ?? Qbot[7] ? [?]Mirai ????.

??? ????? ????? ??? ??? ?? ??? ???? ????? ????? ??????? ??? ????? DDoS ?? ????. ?? ???? ?????????? ????? ??? ???? ??? ???? ??????? ?? Doxxing ???????? ???? ???? ? ????? ?? ?? Discord ???? ???????? ? ????? ? ??????? ??????? ????? ???.

??? ???? ????? ?????? ???: «??????? ??? ???? ?? ???????????? ??? ?? ?????????? ?????????? ????????? ????? ?? ??????? OpenWrt ?? ???? ????????. ??????? ?? Cayosin ?????????? ????? Diicot ???? ????? ????? ????? (?? ??? cryptojacking) ???? ?? ??? ?????? ??? ?? ?? ???? ????? ???????.»

?????????? Diicot ?? ?? ????? ???? ????????? ? ?? ????? ?????? brute-forcing SSH ???? ???????????? ??? ?? ? ??? ?????????? ????? ????? ??? Mirai ? ????? ?????? ??????? ???????.

???? ???? ?? ???????? ??????????? ??? ????? ?? ??? ??? ???:

• Chrome – ?? ????? ???????? ????? ?? Zmap ?? ???????? ????? ?????? ?? ?? ?? ???? ???? (“txt”) ??????.
• ??????????? – ?? ???? ?????? ?? SSH brute-forcer ? Chrome ?? ?????????? ?? ????? ???? ?????? ?????? fetche ? ???? ??????.
• History – ?? ????? ??????? ?? ???? ????? Update ????? ??? ???.

????? brute-forcer SSH? ?? ???? ???? ????? ???? ???? ???? ?? ????? ?????? ?? ?? ?? ?? ?? ???????? IP ??????? ??? ???? ???? ? ?? ???? ??????? ????? ?? ??? ??? ?? ???? IP ?????? ??????.

??? ?? ????? ?? ??? ??????? ???? ?????? ?????? ????? ? ??????? ?? ?? ???? ??????? ?? cryptominer ?? ?????????? CPU ?????? ???? ?? ???? ???? ????? ???????? ?? ????????? ??? ???.

???? ???? ???? ??????? ?? ????????? ????? ?????? ?????? ???????? SSH ? ??????? ?? ???? ????????? ?????? SSH ?? ???????? IP ??? ?????????? ????.

Cado Security ???: «??? ????? ?? ??? ??? ??????? SSH ?? ???? ??????? ?? ????? ???? ??? ???? ???? ?? ??? ???? ??????. ???? ??? ??????/??? ????? ?? ??????? ??????? ?????? ????? ??? ? ???? ??????? ?????? ??????? ? ???? ??????? ???.»

?????

[?] https://www.cadosecurity.com/tracking-diicot-an-emerging-romanian-threat-actor

[?] https://en.wikipedia.org/wiki/Directorate_for_Investigating_Organized_Crime_and_Terrorism

[?] https://thehackernews.com/2021/07/researchers-warn-of-linux-cryptojacking.html

[?] https://thehackernews.com/2023/06/beware-1000-fake-cryptocurrency-sites.html

[?] https://www.akamai.com/blog/security-research/mexals-cryptojacking-malware-resurgence

[?] https://web.archive.org/web/20190414145619/https://perchsecurity.com/perch-news/threat-report-sunday-february-3rd-2019

[?] https://thehackernews.com/2023/06/evasive-qbot-malware-leverages-short.html

[?] https://thehackernews.com/2023/06/active-mirai-botnet-variant-exploiting.html

[?] https://thehackernews.com/2023/06/from-cryptojacking-to-ddos-attacks.html