Tsunami

Based on our research, we have discerned that this botnet perpetually scans the entirety of the internet... every IP address undergoes a scan at least once every hour.

We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly.

T1584.005 Compromise Infrastructure: Botnet The malware includes Botnet functionality.

T1608 Stage Capabilities The infection chain relies on multiple stages hosted on different systems and services.

During this campaign, the threat actor focused on compromising unprotected Redis servers... It’s using Redis’s FLUSHALL issue to create a cron job that downloads a setup script. | The default configuration of standard Kubernetes deployments allow anonymous access to kubelet. TeamTNT used this misconfiguration to gain access to exposed Kubernetes instances and run cryptomining malware in the containers. | TeamTNT targeted Docker daemon ports and abused them to install cryptomining malware and DDoS malware... the script uses the exposed port to spawn a new container from the Alpine image.

T1566 Phishing ... The Threat Actor approaches their victims via LinkedIn and poses as a potential business partner.

It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.

The mass scanning activity observed so far has involved attempts at installing several cryptocurrency miners and the Tsunami backdoor.

In terms of execution and the download command is a bash implementation used to download scripts and binaries from the C2 server.

The vulnerability, CVE-2021-44228, also named #Log4Shell allows for unauthenticated remote code execution and is trivial to exploit.

T1204 User Execution The Initial Access relies on the user executing a backdoored GitHub repository.

When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.

It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.

When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.

When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.

It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.

in a fileless malware attack, the malware is loaded into memory and then executed. By executing malicious code directly from memory, attackers can evade detection by static scanners

When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.

TeamTNT is running the container as a privileged one, and mounting the host, this enables privileged access to the host.

Most of the Gafgyt and Tsunami samples we captured were not packed... String encoding... Necro also cryptographically protects the string by first performing character substitution and then doing zip compression.

a few of the packed samples used the standard UPX shell

A very traditional technique on Linux systems is to use random strings to override argv parameters and prctl(PR_SET_NAME,buf) to change the process name and start parameters in order to disguise the process.

in a fileless malware attack, the malware is loaded into memory and then executed. By executing malicious code directly from memory, attackers can evade detection by static scanners

Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.

The scanners used by Keksec are mainly telnet and SSH weak password scan and exploit scan.

T1539 Steal Web Session Cookie The malware exfiltrates Browser Session Cookies.

T1555 Credentials from Password Stores Multiple Applications and Browsers are accessed for credential access.

Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.

“The core function is still DDoS attacks and scanning”; samples contain scan functions named “ak47Scan” and “ak47telscan.”

T1082 System Information Discovery During Initialization the malware sends hardware and OS information to the C2.

T1083 File and Directory Discovery Specific files are sought out and uploaded to the C2 Server.

Keksec’s malware mainly uses Gafgyt and IRC protocols to send commands.

The IRC protocol is the most widely used protocol in Keksec, and is supported by the Tsunami, Necro and DarkIRC families.

We have observed many cases where the malicious payload contains code with message lookups causing outbound connections through various protocols, effectively creating a backdoor access for remote code execution.

There is also a 4th file ( muser ) that is designed to open a backdoor for the attackers

T1020 Automated Exfiltration The malware automatically and periodically uploads gathered information.

Keksec is trying to make profit from DDoS, mining, stealing user information and selling malware. Through long-term tracking we can see that DDoS attack activity is the most prominent

Tsunami supports various DDoS attack commands... SYNFLOOD ... UDP Flood ... ShellBot supports ... udpflood, tcpflood, httpflood.