Linux Rabbit and Rabbot Malware Leveraged to Install Cryptominers

Digital attackers used new malware called “Linux Rabbit” and “Rabbot” to install cryptominers on targeted devices and servers.

In August 2018, researchers at Anomali Labs came across a campaign where Linux Rabbit targeted Linux servers located in Russia, South Korea, the United Kingdom and the United States. The malware began by using Tor hidden services to contact its command and control (C&C) server. After achieving persistence through “rc.local” files and “.bashrc” files, Linux Rabbit then set to work to brute forcing SSH passwords. If successful, the threat then attempted to install its payloads: the CNRig and CoinHive Monero miners.

The architecture of the targeted machine limited Linux Rabbit to installing only one of these miners successfully. The malware installed CNRig in the event the machine was x86-bit, for example. As for CoinHive, Linux Rabbit could install this machine only if it was an ARM/MISP.

Several months later, Anomali Labs identified a similar campaign in September 2018. This operation involved the self-propagating worm Rabbot. This malware differs from Linux Rabbit in that it’s designed to target vulnerable Internet of Things by exploiting CVE-2018-1149, CVE-2018-9866 and other weaknesses. Even so, Rabbot does share Linux Rabbit’s code base, a similarity which could help explain how the two threats both search for HTML files in order to inject CoinHive scripts into hosted web pages.

At this time, the threat actor responsible for these attack campaigns remains unknown.

ThreatStrem users can learn more about these campaigns here. They can also obtain an in-depth look at Linux Rabbit and Rabbot here and here.

Security researchers can protect their organizations against these types of attack campaigns by using a strong password for SSH users and keys. Additionally, organizations should use a robust endpoint security solution that can both monitor for (Read more...)