We’re months into the disclosure of the log4j vulnerability and new attacks are still popping up. Cybersecurity researchers from Qihoo 360, a Chinese cybersecurity company, have just discovered a new Linux (opens in new tab) botnet, taking advantage of the flaw to distribute rootkits and steal sensitive data.
They named the botnet B1txor20, and claim it uses the log4j vulnerability to target Linux Arm and 64-bit x86 systems.
"In addition to traditional backdoor functions, B1txor20 also has functions such as opening a Socket5 proxy and remotely downloading and installing a rootkit," the researchers said.
Buggy botnet
Besides installing rootkits, the botnet seeks to read and write files, run and terminate proxy services, as well as run reverse shells. It can also exfiltrate data from afflicted endpoints, and run commands, remotely, which could result in the distribution of dangerous malware (opens in new tab).
This is far from a perfect botnet, though, as researchers have also found bugs and non-functional features, as well. One of the bugs deletes the socket file after binding the domain socket making the socket unconnectable, and the whole function useless.
The researchers expect the threat actor will put in additional hours to iron out the kinks, making the botnet even more dangerous than it already is.
"We presume that the author of B1txor20 will continue to improve and open different features according to different scenarios, so maybe we will meet B1txor20's siblings in the future," the group said.
> Log4j could be the most serious security threat ever seen, CISA head warns (opens in new tab)
> Log4j attacks are still a major threat, warns Microsoft (opens in new tab)
> FTC says it will come after firms who haven't patched Log4j flaws (opens in new tab)
The vulnerability, discovered in early December last year in Apache’s logging tool, log4j, has been dubbed one of the most dangerous ones - ever. Log4j is being widely used, and given that the flaw allowed third-party actors remote, full access, to the target device, its destructive potential is limitless.
Once discovered, Apache rushed to develop a patch (opens in new tab), making mistakes along the way. It took multiple attempts, and multiple patches, for the log4j vulnerability to finally be plugged. Administrators everywhere are urged to keep their systems up to date.
- Protect yourself with the best antivirus software (opens in new tab) right now
Via: The Register (opens in new tab)
