WatchDog botnet performs cryptojacking for almost 2 years to take over windows and linux servers.

Daemon — WatchDog:

A botnet is a number of Internet-connected devices, each of which is running one or more bots.

In addition, botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its connection.

Now, recently due to increase in cryptocurrency trading Unit42 discovered botnet operation named WatchDog.

Unfortunately, researchers also found that the operation has been active since January 2019.

WatchDog Functionality

The operation written in of a three-part Go Language binary set and a bash or PowerShell script file.

Firstly,  The binaries perform specific functionality, one of which emulates the Linux watchdog daemon functionality by ensuring that the mining process does not hang, overload or terminate unexpectedly.

Secondly, Go binary downloads a configurable list of IP addresses net ranges before providing the functionality of targeted exploitation operations of identified NIX or Windows systems discovered during the scanning operation. 

Finally, the third Go binary script will initiate a mining operation on either Windows or NIX operating systems (OS) using custom configurations from the initiated bash or PowerShell script.

In short, researchers say “they’ve seen WatchDog infect both Windows and Linux systems.”

Affected Products:

According to an analysis of the WatchDog botnet operations published on Wednesday, Unit 42 estimated the size of the botnet to be around 500 to 1,000 infected systems.

Also, researchers said the botnet operators used 33 different exploits to target 32 vulnerabilities in software such as:

• Drupal
• Elasticsearch
• Apache Hadoop
• Redis
• Spring Data Commons
• SQL Server
• ThinkPHP
• Oracle WebLogic
• CCTV (currently unknown if the target is a CCTV appliance or if there is another moniker “cctv” could stand for).

In addition, WatchDog usually runs with admin privileges and could perform a credentials scan & dump without any difficulty, if its creators ever wished to.

No Data Loss

Importantly, researchers highlighted that WatchDog is not yet on par with recent crypto-mining botnets like TeamTNT and Rocke.

Which in recent months have added capabilities that allow them to extract credentials for AWS and Docker systems from infected servers, according to ZDNet article.

However, to protect systems against this new threat Unit42 team warns to update old vulnerabilities which is only a few keystrokes away for the WatchDog attackers.

Indicators of Compromise

IP Addresses

Domains

URL Addresses

Files