The new Panchan botnet infects Linux servers with miner programs – Bits Media

Computer security specialists at Akamai reported the discovery of a new botnet, which attacks vulnerable SSH servers and distributes mining malware.

In their report, analysts write, that the new botnet has signs of an SSH worm - It infects computers via an SSH connection, where it selects a password using a dictionary and key substitution techniques. After gaining access, the virus places cryptocurrency miners, and tries to hide his activities as much as possible, eg, uses process monitoring and, in case of danger, disables the mining module.

The botnet was discovered “in the wild” in March 2022 of the year. It is written in the Golang programming language. It's a fairly flexible language., which makes it easier to infect various computer architectures and Linux distributions.

After gaining access to the server via SSH, the virus creates a hidden folder and places itself there under the name “xinetd.”. Then contacts a special Discord server via an HTTPS POST request. This is done to track infection by the hackers who produced the malware.. The virus then copies itself as “/bin/system-worker” and registers itself as a new systemd service, to be added to the list of startup programs.

Interesting, that communication between the botnet and the control center is not encrypted and passes through the TCP port 1919. The virus receives the miner configuration and other settings via this port. NiceHash software is used for mining, therefore, Akamai specialists were unable to assess the transactions and scale of the botnet.

Most of the infected networks belong to educational institutions, located in the USA. Wherein, according to certain signs, botnet – originally from Japan.

Microsoft recently spoke about viruses and Cryware hacking methods, allowing you to steal assets from hot crypto wallets.