Facebook Twitter Instagram
    • Privacy Policy
    • Contact Us
    Facebook Twitter Instagram Pinterest Vimeo
    AI Home SecurityAI Home Security
    • Home
    • Home Security
    • Cyber Security
    • Biometric Technology
    Contact
    AI Home SecurityAI Home Security
    Cyber Security

    Cybercriminals Hijacking Vulnerable SSH Servers in New Proxyjacking Campaign

    justmattgBy justmattgJuly 2, 2023No Comments3 Mins Read

    [ad_1]

    Jun 30, 2023Ravie LakshmananServer Security / Cyber Threat

    Proxyjacking Campaign

    An active financially motivated campaign is targeting vulnerable SSH servers to covertly ensnare them into a proxy network.

    “This is an active campaign in which the attacker leverages SSH for remote access, running malicious scripts that stealthily enlist victim servers into a peer-to-peer (P2P) proxy network, such as Peer2Profit or Honeygain,” Akamai researcher Allen West said in a Thursday report.

    Unlike cryptojacking, in which a compromised system’s resources are used to illicitly mine cryptocurrency, proxyjacking offers the ability for threat actors to leverage the victim’s unused bandwidth to clandestinely run different services as a P2P node.

    This offers two-fold benefits: It not only enables the attacker to monetize the extra bandwidth with a significantly reduced resource load that would be necessary to carry out cryptojacking, it also reduces the chances of discovery.

    “It is a stealthier alternative to cryptojacking and has serious implications that can increase the headaches that proxied Layer 7 attacks already serve,” West said.

    To make matters worse, the anonymity provided by proxyware services can be a double-edged sword in that they could be abused by malicious actors to obfuscate the source of their attacks by routing traffic through intermediary nodes.

    Proxyjacking Campaign

    Akamai, which discovered the latest campaign on June 8, 2023, said the activity is designed to breach susceptible SSH servers and deploy an obfuscated Bash script that, in turn, is equipped to fetch necessary dependencies from a compromised web server, including the curl command-line tool by camouflaging it as a CSS file (“csdark.css”).

    The stealthy script further actively searches for and terminates competing instances running bandwidth-sharing programs, before launching Docker services that share the victim’s bandwidth for profits.

    A further examination of the web server has revealed that it’s also being used to host a cryptocurrency miner, suggesting that the threat actors are dabbling in both cryptojacking and proxyjacking attacks.

    Cybersecurity

    While proxyware is not inherently nefarious, Akamai noted that “some of these companies do not properly verify the sourcing of the IPs in the network, and even occasionally suggest that people install the software on their work computers.”

    But such operations can also transcend into the realm of cybercrime when the applications are installed without the users’ knowledge or consent, thereby allowing the threat actor to control several systems and generate illegitimate revenue.

    “Old techniques remain effective, especially when paired with new outcomes,” West said. “Standard security practices remain an effective prevention mechanism, including strong passwords, patch management, and meticulous logging.”

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.



    [ad_2]

    Source link

    Previous ArticleAfrican Nations Face Escalating Phishing & Compromised Password Cyberattacks
    Next Article Architecting XDR to Save Money and Your SOC’s Sanity
    justmattg
    • Website

    Related Posts

    Cyber Security

    Name That Toon: Last Line of Defense

    April 16, 2024
    Cyber Security

    OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt

    April 16, 2024
    Cyber Security

    Middle East Cyber Ops Intensify, With Israel the Main Target

    April 16, 2024
    Add A Comment

    Leave A Reply Cancel Reply

    Facebook Twitter Instagram Pinterest
    • Privacy Policy
    • Contact Us
    AI Home Security © 2025 All rights reserved | Designed By ESmartsSolution

    Type above and press Enter to search. Press Esc to cancel.

    ↑