IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Linux botnet spreads using Log4Shell flaw

The malware uses DNS tunnelling to communicate with its C2 control server

The B1txor botnet, which is spreading via the Log4Shell flaw, enables attackers to get shell access to Linux systems and install a rootkit.

Chinese security company 360Netlab discovered and named the bot in February and publicly disclosed it this week. It takes the form of a backdoor for Linux that uses DNS tunnelling for its command and control (C2) communications.

The researchers observed the software propagating via the Log4Shell flaw in the Logj logging system that was first discovered in December.

The domain information that it uses to communicate with its C2 server is encrypted. Once the botnet client has decrypted it, it uses a DNS query to send its communications to the C2 domain, including stolen information and command execution results. The C2 server sends the next payload in the body of a DNS response.

The payload supports 14 instructions, which include simple beaconing to the C2 server, uploading system information, reading and writing files, forwarding traffic, opening a shell, and executing arbitrary system commands. The backdoor can also start a proxy service.

The botnet is buggy, according to the Netlab360 team, with one socket binding function rendered entirely inoperable thanks to code mistakes. Nevertheless, enough of the code works to make it a threat.

Related Resource

The state of SD-WAN, SASE and zero trust security architectures

Be a leader in the deployment of zero trust, SD-WAN and SASE

Whitepaper cover with graphic of a man stood on a laptop in front of a padlock, in front of a cloud with a server in the cloud, plus other peopleFree Download

"We presume that the author of B1txor20 will continue to improve and open different features according to different scenarios, so maybe we will meet B1txor20's siblings in the future," they said in an analysis of the malware.

Linux backdoors are popular for attacking the servers that run large portions of the internet. In November, criminals were found using one to compromise e-commerce sites with a software skimmer. In August, Trend Micro reported that hackers were targeting outdated versions of the operating system to gain control of resources in the cloud.

Last month, VMware researchers identified increased ransomware attacks against Linux servers in multi-cloud operating environments and called for more countermeasures.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Most Popular

16 ways to speed up your laptop

16 ways to speed up your laptop

13 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022
Preparing for the 3G sunset
Network & Internet

Preparing for the 3G sunset

18 May 2022