New Xbash malware is a ransomware and cryptocurrency mining double-threat

Xbash deletes databases on Linux and mines cryptocurrency coins on Windows

hacking and ransomware

A new strain of composite malware has been discovered that is capable of delivering a ransomware payload and cryptocurrency mining exploits, against both Linux and Microsoft Windows servers.

Dubbed Xbash by security experts at Palo Alto Networks' Unit 42, the malware is believed to be tied to Chinese threat actors Iron Group. The collective has previously been connected to a number of ransomware attacks, sometimes under the name Roche'.

According to Unit 42, the malware also has self-propagating capabilities and worm-like characteristics, similar to the WannaCry strain that wreaked havoc on NHS systems in the summer of 2017. Essentially, the strain is being treated as an amalgamation of different malware types, capable of throwing a number of threats at a target at once.

The malware is capable of adapting the style of attack it uses depending on whether Linux or Windows is being targeted. On the former, Xbash will focus on destroying data and launching ransomware, whereas on the latter the malware will execute a cryptocurrency coinminer.

Xbash, which was built using Python, infects systems by targeting weak passwords and specific vulnerabilities, then at least on Linux deletes databases including MySQL, PostgreSQL and MongoDB. It displays a ransom note, although the researchers say the malware does not seem to contain functionality to recover deleted databases.

"We have discovered four different versions of Xbash so far," Unit 42 wrote. "Code and timestamp differences among these versions show that it's still under active development."

The researchers have observed 48 incoming transactions to the Bitcoin wallet used by the malware, amounting to 0.964 bitcoins. At the time of writing, that equates to around 4,700.

The malware is notable for combining botnet, ransomware and coinmining capabilities as well as its ability to discern operating system.

More technical details can be found on Unit 42's blog, which advises organisations to protect themselves by using strong passwords, keeping on top of security updates and implementing endpoint security on Microsoft Windows and Linux systems.

Featured Resources

Unleashing the power of AI initiatives with the right infrastructure

What key infrastructure requirements are needed to implement AI effectively?

Download now

Achieve today. Plan tomorrow. Making the hybrid multi-cloud journey

A Veritas webinar on implementing a hybrid multi-cloud strategy

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

Recommended

Your essential guide to internet security
Security

Your essential guide to internet security

27 Jan 2021
Android malware vendor teams with marketer to promote new malware
malware

Android malware vendor teams with marketer to promote new malware

11 Jan 2021
Python-based malware steals Outlook files and browser credentials
malware

Python-based malware steals Outlook files and browser credentials

15 Dec 2020
Subway UK customers targeted by Trickbot hackers
hacking

Subway UK customers targeted by Trickbot hackers

14 Dec 2020

Most Popular

How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
Hackers are actively exploiting three Apple iOS flaws
exploits

Hackers are actively exploiting three Apple iOS flaws

27 Jan 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

26 Jan 2021