In late January, a new botnet campaign was discovered targeting unpatched software running on Linux devices with recent code execution CVEs. Once a device is compromised, the bot downloads and executes a malicious Python script that joins the compromised device to the botnet. The botnet is controlled by attackers using Internet Relay Chat (IRC) and enables the attackers to perform DDoS attacks and run crypto miner software on infected devices. Updates are available to patch all CVEs exploited
In August 2020, the NSA and FBI published a joint security alert containing details about a previously undisclosed Russian malware. The entire report can be viewed here
The agencies say that the Linux strain malware has been developed and deployed in real-world attacks by Russian military hackers. The FBI says, “The Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165, whose activity is sometimes identified by the private sector
Note: this page contains paid content.
Please, subscribe to get an access.