How does Linux Malware Detect 35% of Advancement During 2021?

How does Linux Malware Detect 35% of Advancement During 2021?

The Number of Malware bugs targeting Linux devices developed by 35% in 2021, most usually to volunteer IoT devices for DDoS (distributed denial of service) attacks. IoTs, are consistently underpowered by the “smart” devices running different Linux distributions and are limited to specific functionality. However, when their resources are linked into large gangs, they can transmit massive DDoS attacks to even strongly secured frameworks.

Besides DDoS, Linux IoT devices are volunteered to mine cryptocurrency, provide spam mail operations, deliver as broadcast, act as command and control servers, or even act as entry points into corporate networks.

  • According to the report looking into the attack data from 2021 summarizes the following:
  • In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020.
  • XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021.
  • Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one.
  • XorDDoS also had a notable year-over-year increase of 123%.

Malware Analysis

XorDDoS is an accomplished Linux Trojan that works in different Linux systems architectures, from ARM (IoT) to x64 servers. It utilizes XOR encryption for C2 communications, hence the name. While attacking IoT systems, XorDDoS brute-force vulnerable devices through SSH. On Linux machines, it utilizes port 2375 to achieve credentials-less root access to the host.

A well-known case of the malware’s distribution was shown in 2021 after a Chinese threat actor aka “Winnti” was observed setting up it with various other derivative botnets. Mozi is a P2P botnet relying on the distributed hash table (DHT) lookup system to hide suspicious C2 communications from network traffic monitoring solutions.

The particular botnet has been around for a while, continually adding more vulnerability and expanding its targeting scope.

How-Linux-Malware-Detect-35%-of-Advancement-During-2021-image1

Mirai is a notorious botnet that spawned numerous forks due to its publicly available source code that continues to plague the IoT world. The various derivatives implement different C2 communication protocols, but they all typically abuse weak credentials to brute-force into devices.

We covered several notable Mirai variants in 2021, like “Dark Mirai,” which focuses on home routers, and “Moobot,” which targets cameras. “Some of the most prevalent variants tracked by our security researchers involve Sora, IZIH9, and Rekai,” says security researcher in the report. “Compared to 2020, the numbers of identified samples for all three variants have increased by 33%, 39% and 83% respectively in 2021.”

A trend that continues into 2022

The Xiarch’s findings aren’t surprising as they confirm an ongoing trend that emerged in previous years. For example, an Intezer report analyzing 2020 stats found that Linux malware families increased by 40% in 2020 compared to the previous year.

How-Linux-Malware-Detect-35%-of-Advancement-During-2021-image2

In the first six months of 2020, a steep rise of 500% in Golang malware was recorded, showing that malware authors were looking for ways to make their code run on multiple platforms. This programming, and by extension, targeting trend, has already been confirmed in early 2022 cases and is likely to continue unabated.           

Leave a Reply