Romanian cybercrime gang Diicot builds DDoS botnet with Mirai variant

A cybercriminal group calling itself Diicot is performing mass SSH brute-force scanning and deploying a variant of the Mirai IoT botnet on compromised gadgets, in response to researchers. The group additionally deploys a cryptocurrency mining payload on servers with CPUs which have greater than 4 cores.

“Though Diicot have historically been related to cryptojacking campaigns, Cado Labs found proof of the group deploying an off-the-shelf Mirai-based botnet agent, named Cayosin,” researchers from Cado Safety mentioned in an evaluation of the group’s latest and ongoing assault marketing campaign. “Deployment of this agent was focused at routers working the Linux-based embedded gadgets working system, OpenWrt.”

What’s Diicot?

The Diicot group has been round since at the very least 2021 and was once known as Mexals. Researchers have sturdy indications that the group relies in Romania after investigating strings present in its malware payloads, scripts, and messages towards rival hacker teams. Even its new identify mimics the acronym for the Directorate for Investigating Organized Crime and Terrorism (DIICOT) a Romanian law-enforcement company that additionally investigates and prosecutes cybercrime beneath its organized crime preventing mandate.

In previous campaigns, first documented by antivirus agency Bitdefender in 2021, the group’s important focus has been cryptojacking — the observe of hijacking computing energy for cryptocurrency mining. The group used to focus on Linux servers with weak SSH credentials by utilizing customized and centralized mass scanning and brute-force script that attempted numerous usernames and password mixtures. If a server was efficiently compromised, the group deployed a customized model of the open-source XMRig software program to mine Monero.

The group’s campaigns continued, however earlier this yr researchers from Akamai famous the group’s identify change and the diversification of its assault toolkit, including an SSH worm written in Golang and the deployment of a Mirai variant known as Cayosin. Mirai was a self-propagating botnet designed to contaminate embedded networking gadgets that initially appeared in 2016 and was answerable for among the largest DDoS assaults noticed on the time. The botnet’s supply code was later revealed on-line, permitting cybercriminals to develop many different improved variants based mostly on it.

Diicot’s newest assault marketing campaign

The assault marketing campaign investigated by Cado Safety makes use of most of the identical ways documented by Bitdefender and Akamai and seems to have began in April 2023, when the Discord server used for command-and-control was created.

The assault begins with the Golang SSH brute-forcing software that the group calls aliases. This software takes a listing of goal IP addresses and username/password pairs after which makes an attempt to brute-force authentication.
If the compromised system runs OpenWRT, a Linux-based open-source working system for networking gadgets similar to routers, the attackers will deploy a script known as bins.sh that is answerable for figuring out the gadget CPU structure and deploying a Cayosin binary compiled for that structure beneath the identify cutie.<arch>.

If the system is just not working OpenWRT, the aliases software deploys certainly one of a number of Linux binary payloads created with an open-source software known as the shell script compiler (SHC) software and filled with UPX. All these payloads function malware loaders and put together the system for the deployment of the XMRig variant.

Script checks for techniques with 4 or extra CPU cores

One of many SHC payloads is definitely named “payload” and executes a bash script that checks if the system has 4 CPU cores earlier than deploying XMRig. The script additionally adjustments the password for the present person it is executed beneath. If the person is root, the password is about to a hardcoded worth, but when it isn’t, the password is generated dynamically from the present date.

Payload additionally deploys one other SHC executable known as .diicot that provides an attacker-controlled SSH key to the present person to make sure future entry and makes certain the SSH service is working and registered as a service. The script then proceeds to obtain the customized XMRig variant and put it aside with the identify Opera together with its configuration file. It additionally creates a cron script to test for and relaunch the Opera course of if it isn’t working.

The payload software downloads one other SHC executable known as “replace” that deploys the alias’s brute-force software on the system and a duplicate of the Zmap community scanner beneath the identify “chrome.” The replace executable additionally deploys a shell script known as “historical past” that executes Replace itself after which creates a cron script that ensures the historical past and chrome executables are working on the system.

Diicot employs instruments for extra than simply cryptojacking

The chrome Zmap scanner is run towards a community block generated by the replace software and saves the leads to a file known as bios.txt. The targets on this file are then utilized by aliases to carry out SSH brute-force assaults together with a listing of usernames and passwords that the Replace software additionally generates.

“Using Cayosin demonstrates Diicot’s willingness to conduct quite a lot of assaults (not simply cryptojacking) relying on the kind of targets they encounter,” the Cado researchers mentioned. “This discovering is in line with Akamai’s analysis, suggesting that the group continues to be investing engineering effort into deploying Cayosin. In doing so, Diicot have gained the flexibility to conduct DDoS assaults, as that is the first goal of Cayosin in response to earlier reporting.”

Organizations ought to be sure that they implement fundamental SSH hardening for his or her servers. This implies utilizing key-based authentication as an alternative of passwords and utilizing firewall guidelines to limit SSH entry to solely trusted IP addresses. Detecting Diicot scanning originating from a system must be simple on the community stage as it’s fairly noisy, the researchers mentioned.