A New Fileless P2P Botnet Malware Targeting SSH Servers Worldwide

Cybersecurity researchers today took the wraps off a classy, multi-functional peer-to-peer (P2P) botnet written in Golang that has been actively targeting SSH servers since January 2020.

Called "FritzFrog," the modular, multi-threaded and file-less botnet has breached quite 500 servers so far , infecting well-known universities within the US and Europe, and a railway company, consistent with a report released by Guardicore Labs today.

"With its decentralized infrastructure, it distributes control among all its nodes," Guardicore's Ophir Harpaz said. "In this network with no single-point-of-failure, peers constantly communicate with one another to stay the network alive, resilient, and up-to-date."

In addition to implementing a proprietary P2P protocol that's been written from scratch, the communications are done over an encrypted channel, with the malware capable of making a backdoor on victim systems that grants continued access for the attackers.

A Fileless P2P Botnet

Although GoLang based botnets are observed before, like Gandalf and GoBrut, FritzFrog appears to share some similarities with Rakos, another Golang-based Linux backdoor that was previously found to infiltrate target systems via brute force attempts at SSH logins.

p2p malware

But what makes FritzFrog unique is that it's fileless, meaning it assembles and executes payloads in-memory, and is more aggressive in completing brute-force attacks, while also being efficient by distributing the targets evenly within the botnet.

Once a target machine is identified, the malware performs a series of tasks involving brute-forcing it, infecting the machine with malicious payloads upon a successful breach, and adding the victim to the P2P network.

netcat ssh malware

To slip under the radar, the malware runs as ifconfig and NGINX and begins listening on port 1234 to receive further commands for execution, including those for syncing the victim with the database of network peers and brute-force targets.

The commands themselves are transmitted to the malware through a series of hoops designed to avoid detection. The attacker node within the botnet first latches onto a selected victim over SSH then uses the NETCAT utility to determine a reference to a foreign server.

What's more, the payload files are exchanged between nodes in BitTorrent-style, employing a segmented file transfer approach to send blobs of knowledge .

"When a node A wishes to receive a file from its peer, node B, it can query node B which blobs it owns using the command getblobstats," Harpaz said. "Then, node A can get a selected blob by its hash, either by the P2P command getbin or over HTTP, with the URL 'https://node_IP:1234/blob_hash.' When node A has all the needed blobs, it assembles the file employing a special module named Assemble and runs it."

p2p malware

Aside from encrypting and encoding the command responses, the malware runs a separate process, named "libexec," to mine Monero coins and leaves a backdoor for future access to the victim by adding a public key to the SSH's "authorized_keys" file in order that logins are often authenticated without having to believe the password again.

13,000 Attacks Spotted Since January

The campaign began on January 9, consistent with the cybersecurity firm, before reaching a cumulative of 13,000 attacks since its introduction spanning across 20 different versions of the malware binary.

world map bug 

Aside from targeting educational institutions, FritzFrog has been found to brute-force many IP addresses belonging to governmental organizations, medical centers, banks, and telecom companies.

Guardicore Labs has also made available a detection script that checks if a server has been infected by FritzFrog, along side sharing the opposite indicators of compromise (IoCs).

"Weak passwords are the immediate enabler of FritzFrog's attacks," Harpaz concluded. "We recommend choosing strong passwords and using public key authentication, which is far safer. Routers and IoT devices often expose SSH and are thus susceptible to FritzFrog — consider changing their SSH port or completely disabling SSH access to them if the service isn't in use."