The cybercriminal organisation behind the InterPlanetary Storm malware has released a new variant into the wild, now targeting Mac and Android, in addition to Windows and Linux machines, according to new research from cloud-enabled security solutions provider, Barracuda Networks.
In its most recent Threat Spotlight, Barracuda found that the malware is building a botnet, which its researchers estimate currently includes roughly 13,500 infected machines located in 84 different countries around the world, with the majority (62%) based in Asia.
The majority of the machines infected by the malware are located in Asia.
- 59% of infected machines are in Hong Kong, South Korea, and Taiwan
- 8% are in Russia and Ukraine
- 6% are in Brazil
- 5% are in the United States and Canada
- 3% are in Sweden
- 3% are in China
- All other countries are 1% or less
Known as InterPlanetary Storm because it uses the InterPlanetary File System (IPFS) p2p network and its underlying libp2p implementation, the malware, which targeted Windows machines, was uncovered in May 2019, and a variant capable of attacking Linux machines was reported in June of this year. This new variant, which Barracuda researchers first detected in late August, is targeting IoT devices, such as TVs that run on Android operating systems, and Linux-based machines, such as routers with ill-configured SSH service.
The new variant gains access to machines by running a dictionary attack against SSH servers, similar to FritzFrog, another peer-to-peer (p2p) malware. It can also gain entry by accessing open ADB (Android Debug Bridge) servers. The malware detects the CPU architecture and running OS of its victims, and can run on ARM-based machines – CPUs based on reduced instruction set computer architecture (RISC), which are quite common in routers and other IoT devices.
“While the botnet that this malware is building does not have clear functionality yet, it gives the campaign operators a backdoor into the infected devices so they can later be used for cryptomining, DDoS, or other large-scale attacks, said James Forbes-May, Vice President of APAC for Barracuda.
“We have seen many cases of the new variant in Asia, so far targeting IoT devices in China, Hong Kong, South Korea, and Taiwan, but these cases continue to rise, so it’s important to remain vigilant.”
Barracuda researchers found several unique features designed to help the malware protect itself once it has infected a machine. These include automatically updating itself to the latest available version; installing a service using a Go daemon package, and killing other processes on the machine that pose a threat to the malware, such as debuggers and competing malware.
“In order to protect against such attacks, it’s incredibly important to properly configure SSH access on all devices, said Forbes-May. “This means using keys instead of passwords, which will make access more secure. When password login is enabled and the service itself is accessible, the malware can exploit the ill-configured attack surface. This is an issue common with routers and IoT devices, so they make easy targets for this malware, he added.
“Using a cloud security posture management tool to monitor SSH access control to eliminate any configuration mistakes, which can be catastrophic, is crucial, while deploying an MFA-enabled VPN connection and segmenting your networks, rather than granting access to broad IP networks, can provide an additional layer of security against this kind of attack.”
