New 'Bondnet' Botnet Mines Cryptocurrencies

A newly detected botnet, made up of thousands of compromised servers, has infected more than 15,000 machines since it became active in December 2016. "Bondnet" is currently used to mine cryptocurrencies, primarily the open-source Monero.

It was discovered in January 2017 by the Guardicore Global Sensor Network (GGSN) at Guardicore Labs, which was unveiled April 24. The GGSN, a network of deception servers in data centers around the world, streams threat information to detect and analyze new attacks.

"The straight-forward goal is money," says Ofri Ziv, VP of research and head of GuardiCore Labs, describing Bondnet. Its attacker, operating under the alias Bond007.01, manages and controls the botnet remotely to earn the equivalent of one thousand dollars in Monero coins each day.

"In addition to this, given the attacker's technical infrastructure, he could easily pivot to deploying ransomware on thousands of servers immediately, or creating a high-bandwidth DDoS botnet," Ziv continues.

Renting the botnet is also not out of the question. He notes how Bondnet has reached some "interesting" organizations, large companies, universities, and government networks. "If he decides to pivot to selling access, we can imagine plenty of organizations that would be interested in a foothold inside these networks," Ziv explains.

The attacker uses a mix of old vulnerabilities and username/password combinations to attack mostly Windows Server machines, researchers found. New victims are found using a TCP port scanner called WinEggDrop, which gives an updated list of IPs with open ports. The attacker targets victims with a variety of public exploits and installs a Windows Management Interface (WMI) back door on each one. WMI enables communication with a C&C server, which enables the attacker to fully control the servers and take data, hold it for ransom, and use the server to launch more attacks.

Researchers discovered 2,000 machines report to the C&C server each day. About 500 new machines are added to the attacker's network on a daily basis, and about the same number is delisted.

"Businesses with infected servers are at a double risk," Ziv explains. "Foremost is that the attacker has created two pathways in which he can control the infected server (via the WMI RAT and the back door user), with which he can do practically anything."

The back door user is also easy to test remotely, he continues, noting that it lets other attackers search online for victimized servers and connect to them. Infected organizations are open to several types of attacks, from Bond007.01 and others, ranging "from ransomware demands to full-blown compromise."

Businesses looking to protect themselves should monitor all services, particularly Internet-facing ones, for resource usage spikes and unexpected network connections. Network-based monitoring systems can also alert organizations to known malware and suspicious activity.

Internet-facing services should be locked down, says Ziv. For example, MySQL servers are Bondnet's most common victims. Locking down MySQL to prevent running random SQL commands would have protected the infection vector for this attack.

"In addition, regular monitoring of all WMI activity and all user accounts is important," he continues. "Monitoring modifications such as changing user passwords would have quickly alerted the relevant security team, which could investigate the incident."

Related Content