V3G4 Botnet Evolves: From DDoS to Covert Cryptomining

MITRE Techniques

• [T1592 ] Gather Victim Host Information – Collects system details (kernel, architecture, process limits) for registration and targeting (‘Collects system details using uname, process limits, architecture, and hostname for C2 registration’)
• [T1583.003 ] Acquire Infrastructure — Infrastructure as a Service – Uses attacker-controlled servers (103.149.93[.]224, 159.75.47[.]123) to host payloads and C2 (‘C2 and payload distribution servers hosted at 103.149.93[.]224 and 159.75.47[.]123’)
• [T1078 ] Valid Accounts – Attempts SSH brute-force propagation to gain access to other Linux hosts (‘SSH brute-force attempts to gain credentials and access additional Linux hosts’)
• [T1059.004 ] Command and Scripting Interpreter — Unix Shell – Downloader script uses curl/wget to fetch and execute architecture-specific bot binaries (‘Downloader script uses curl/wget to fetch and execute the bot payload’)
• [T1106 ] Native API – Uses syscalls (setsid, prctl) to detach, rename process, and evade detection (‘renames/processes set to appear like legitimate system services (e.g., systemd-logind)’)
• [T1036.005 ] Masquerading – Renames process and attempts to modify /proc/self/cmdline to appear as systemd-logind (‘masquerades as system daemon (“systemd-logind”) using prctl(2) & modifies “/proc/self/cmdline”’)
• [T1027 ] Obfuscated/Encrypted Files or Information – UPX-packed and stripped binaries to complicate static analysis (‘Payloads are UPX-packed and stripped to complicate analysis’)
• [T1564.001 ] Hide Artifacts — Hidden Files/Directories – Drops miner as /tmp/.dbus-daemon to blend with legitimate files (‘Miner dropped as /tmp/.dbus-daemon to blend with legitimate files’)
• [T1016 ] System Network Configuration Discovery – Discovers networking details to inform scanning and registration (‘High-speed SSH scanning across the Internet… crafts SYN packets to port 22’)
• [T1082 ] System Information Discovery – Gathers kernel, architecture, and host identifiers during initialization (‘gathers basic information about the victim, including kernel and architecture details via uname(2)’)
• [T1021.004 ] Remote Services — SSH – Leverages SSH scanning/brute-force to propagate and move laterally (‘High-speed SSH scanning across the Internet… indicating automated scanning and potential brute-force activity’)
• [T1071.004 ] Application Layer Protocol — DNS – Multi-threaded DNS queries to 8.8.8.8 to resolve C2 domain and maintain connectivity (‘spawns multiple worker threads that each perform DNS queries against 8.8.8.8 to resolve its C2 server’)
• [T1571 ] Non-Standard Port – Uses non-standard/ephemeral ports and localhost listeners for C2 and IPC (e.g., 159.75.47[.]123:60194, 127.0.0.1:63841) (‘Localhost TCP listener on 127.0.0.1:63841’ and ‘159.75.47[.]123:60194 used to fetch miner configuration’)
• [T1498 ] Network Denial of Service – Botnet has DDoS capabilities consistent with Mirai-derived strains (‘Capable of launching DDoS attacks’)
• [T1496 ] Resource Hijacking – Deploys XMRig to mine Monero and consume system resources for profit (‘Deploys XMRig to consume CPU resources and mine Monero for financial gain’)