Thousands of Linux servers are still infected by Ebury, a decades-old information-stealing malware that was thought extinct.
Ebury is a sophisticated piece of malware designed to compromise Linux-based systems, particularly servers. It’s a type of backdoor and credential-stealing malware that allows attackers to gain unauthorized access to compromised systems.
Ebury’s developers are financially motivated, in newer times expanding into the cryptocurrency space, as well. Ebury also seems to be used for spam and web traffic redirection.
Targeting hosting providers
When cybersecurity researchers from ESET first reported on Ebury a decade ago, the report resulted in the arrest of the malware’s operators. However, that didn’t stop the malware from being updated and growing in the years since. Cumulatively, since 2009, some 400,000 Linux-powered servers have been infected by this backdoor.
At the end of last year, more than 100,000 endpoints were thought to still carrying the infection, according to a follow-up report (PDF) that ESET published earlier this week.
Key Ebury victims seem to be hosting providers, the researchers found. “The gang leverages its access to the hosting provider’s infrastructure to install Ebury on all the servers that are being rented by that provider,” they explained. As part of an experiment, they rented a virtual server and suffered an infection within a week.
“Another interesting method is the use of adversary in the middle to intercept SSH traffic of interesting targets inside data centers and redirect it to a server used to capture credentials,” they added.
Last year, more than 200 servers were targeted by Ebury operators. Among the targets were many Bitcoin and Ethereum nodes, as one of Ebury’s main features was to automatically steal cryptocurrency wallets hosted on the targeted server, as soon as the victim logs in with a password.
Via BleepingComputer
