VB2021 paper: The Keksec botnets we observed in the past year THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR Ye Jin & Lingming Tu Qihoo 360, China jinye@360.cn tulingming@360.cn 7 - 8 October, 2021 / vblocalhost.com www.virusbulletin.com THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 2 VIRUS BULLETIN CONFERENCE OCTOBER 2021 ABSTRACT The Keksec group was created in 2016 by a number of experienced botnet actors. They kept silent for a period of time in 2020, and resumed activity after August 2020 with nearly 20 botnet campaigns detected by us. In this paper we will study those campaigns in detail in terms of samples, exploits and C2 servers. Our analysis depicts the big picture of Keksec botnets since August 2020 and we believe that it will help defenders to better detect and mitigate against future botnet threats from Keksec and other similar groups. 1. INTRODUCTION We have seen a rapid proliferation of Linux malware/botnets in recent years. While it’s not uncommon to find that many of them were created by script kiddies using easily obtained malware kits (e.g. Mirai and Gafgyt source code), according to our data over 50% of them were created by a relatively small number of professional actors who have persistence in operating Linux botnets. Compared with script kiddies, they usually have more resources and are more skilful, and are thus worthy of more attention. The Keksec group is just one such threat actor. It became well known for building the Necro/Freakout botnet early this year. Further digging shows that it has a long history of running DDoS botnets, with the first one traced back to 2016. Interestingly, the members of the Keksec group were very open in showing off their attacking activities. For example, they used to publicize their invasions to a public billboard on social media. They also created an open directory in pastebin.com to hold their source and attack tools. The ease of accessing this information has helped us summarize the high profile group as follows: • Keksec group was built in 2016 by a few experienced botnet actors. • They preferred DDoS and miner types of botnets. • They had a rich set of popular botnet kits targeting both Windows and Linux machines. For reasons unknown to us, the group kept silent for a period in 2020. Our data shows that their hacking activities were not resumed until August 2020. We detected nearly 20 botnet campaigns after that time. Detailed studies have been carried out on the collected data in terms of samples, exploits, and C2 servers. With the help of passive DNS, we obtained interesting results, which make us believe that it is possible to depict the big picture of Keksec botnets since August 2020. The remainder of this paper is organized as follows: in Section 2, we summarize the nearly 20 campaigns we detected since 2020/08; in Sections 3, 4, and 5, we analyse those campaigns separately in terms of exploits, malware families and operations. To summarize, the contributions of this paper are as follows: • We analyse how the Keksec group exploited a large number of vulnerabilities to attack both Linux and Windows machines, especially how they quickly used some 1-day exploits. • We summarize the three major botnet families that have been heavily used by Keksec. • We demonstrate their techniques in terms of code reuse, IRC protocol, DGA and Tor. • We deduce the sample delivering and updating patterns. • Plenty of C2 infrastructure was owned by this group. The C2 infrastructures we found are given in the Appendix. 2. CAMPAIGNS We analysed the historical activities of Keksec by combing the attack activities from 2020/08 to the present, starting with samples and exploits. First, we summarized the corresponding YARA rules by analysing the historical samples, and scanned back through the sample database to find the hit samples. Then we grouped them by sample similarity clustering and, using manual inspection, removed the false positive samples that clearly did not belong to Keksec, leaving about 5,000. We use this as a seed to expand the sample set through our own threat intelligence mining system, correlating queries on capture time, exploit, and some other relevant attributes. In the past year we captured a total of 23 exploits, 5,564 samples, and three malware families (ignoring variant classification). We use these data as a basis to comb through Keksec’s historical attack activity. We generated a chart showing chronicled Keksec attacks (Figure 1). We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly. The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro [1]. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 3VIRUS BULLETIN CONFERENCE OCTOBER 2021 3. EXPLOITS Keksec launches two types of scanning attacks, one using a dedicated scanning server, and the other using the sample’s built-in scanning capabilities. We do not distinguish between these two scanning methods, and only focus on the scan payload information for statistics. We counted the new exploits and the corresponding propagated families in chronological order. First seen Exploit (CVE) Exposure time Target device / software Family 1 2020.8.26 Realtek Tsunami 2 2020.9.3 Realtek Gafgyt 3 2020.9.20 Huawei_Router Gafgyt 4 2020.9.25 Avtech_Camera_RCE Gafgyt 5 2020.10.21 ThinkPHP_RCE Gafgyt 6 2020.11.2 JAWS_DVR_RCE Gafgyt 7 2020.11.11 ZTE_Router_RCE Gafgyt 8 2020.11.19 yarn_api Gafgyt 9 2020.11.19 Avtech_IP_Camera_ACI Gafgyt 10 2020.11.24 Zyxel_VIEWLOG_RCE Gafgyt 11 2020.11.26 ZeroShell_Kerbynet_RCE Gafgyt 12 2021.1.8 CVE-2020-7961 2020.7 Liferay Portal Necro 13 2021.1.8 CVE-2020-35665 2020.12.23 TerraMaster Necro 14 2021.1.8 CVE-2021-3007 2021.1.3 Zend Framework Necro 15 2021.3.10 WebLogic RCE Necro 16 2021.3.20 CVE-2021-21972 2021.2.27 VMware_vCenterServer Necro 17 2021.3.23 SonicWALL_XMLRPC_settimeconfig_RCE Gafgyt 18 2021.4.26 F5_iControl_mgmt_RCE Gafgyt 19 2021.5.1 VestaCP Necro 20 2021.5.1 SCO Openserver Necro 21 2021.5.1 Genexis PLATINUM Necro 22 2021.5.1 OTRS 6.0.1 Necro 23 2021.5.1 Unknown (Nrdh.php) Necro Table 1: Exploit stats. Comparing the point in time when the new exploit was added and the POC exposure time we can see that Keksec’s utilization of 1-days is very fast. Especially after the start of Necro propagation, the attack activity can often be seen within two to three days of POC exposure. 4. MALWARE FAMILIES Keksec developed several families of malicious programs across Window and Linux systems, involving PC, server, multiple IoT platforms, and created a complicated botnet platform, here are some breakdowns: Figure 1: Chronicled Keksec attacks. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 4 VIRUS BULLETIN CONFERENCE OCTOBER 2021 • Linux-based: Tsunami (Capsaicion, Ziggy), Gafgyt (LULzbOT, Oreo, Gafgyt_tor) • Windows-based: DarkIRC (AutoIt packed) [2], DarkHTTP (AutoIt packed) • Developed in Python to target dual systems: Necro • From open-sourced projects: Rootkit, Miner, JS Bot Keksec actively maintains three main families, Gafgyt, Tsunami and Necro, with new features constantly being added. While Necro’s framework is developed by Keksec itself, the threat group inherits the other two families from open- source code. Our analysis shows that Keksec has extraordinarily strong code management capabilities, using open- source or leaked code to develop different variants extensively, which leads to variant chaos. For example, Freak, a key member of Keksec, developed and open-sourced two Tsunami (a.k.a. Kaiten, a long established IRC botnet family) variants of Capsaicion [3] and Ziggy Redo. However, we found some Tsunami samples that mix codes of both Capsaicion and Ziggy. Figure 2: Tsunami variant of Capsaicion. Figure 3: Tsunami variant of Ziggy Redo. The same sort of chaos also exists in Gafgyt variants including LulZBoT, Oreo, bigB04t and Simps. Some variants even reuse Tsunami code. As for Necro, the purely Python developed family not only reuses the IRC protocol for C2 communication, but also borrows many key features from open-source projects. Due to that complication, we do not follow the naming of Keksec to classify the variants, but break down their samples into the three main families of Gafgyt, Tsunami and Necro to summarize and analyse the technical points and design ideas they share. Scanners The scanners used by Keksec are mainly telnet and SSH weak password scan and exploit scan. Telnet scan The telnet weak password scan of the open-source version of Tsunami uses a function called BurnTheJews, as shown in Figure 4. In the captured sample we found that Keksec uses a function called ak47telscan, shown in Figure 5. The two sets of code algorithms are almost identical, only the standard output section has any difference. The sample first detects if the device supports raw sockets, and if it does, it uses Mirai’s telnet scan code, scanner_init. It if doesn’t support raw sockets, ak47telscan will be used. In fact, the ak47telscan function is also from publicly available source, not created by Keksec. The relevant code is shown in Figure 6. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 5VIRUS BULLETIN CONFERENCE OCTOBER 2021 Figure 4: Telnet scan function of BurnTheJews(). Figure 5: Keksec’s scan function of ak47telscan(). THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 6 VIRUS BULLETIN CONFERENCE OCTOBER 2021 Figure 6: The publicly available ak47 scan function. SSH scan The SSH weak password scan is done by the Necro botnet. Necro first tries to install the paramiko library on the device, and if it succeeds, it adds port 22 to the list of scanned ports, and if it fails to install the library, it just gives up the 22 scan. Figure 7: Necro code for installing paramiko. After receiving the scan command, the built-in weak password brute force starts, as shown in Figure 8. SSH weak passwords are constantly updated by version upgrades, and new weak passwords are added to replace some of the less effective ones. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 7VIRUS BULLETIN CONFERENCE OCTOBER 2021 Exploit scan All samples contain an exploit scan. In Tsunami and Gafgyt, the exploit scan is placed in ak47scan. There is scanning code for Huawei and Realtek devices. According to our observation and analysis, Keksec does not have 0-day discovery capabilities, so most of the POC codes are publicly available. If the POC is implemented in C, it can be integrated into Tsunami and Gafgyt with simple modifications, and if the POC code is implemented in Python, it can be integrated into the Necro family. In some individual variants the number of exploits implemented can go up to dozens. The three more popular exploits integrated by Necro can be seen in Figures 9–11, and the original POCs for these codes can be found online. 1. TerraMaster RCE: CVE-2020-28188 Figure 8: Necro SSH weak password scan code. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 8 VIRUS BULLETIN CONFERENCE OCTOBER 2021 2. VMware vCenter Server RCE: CVE-2021-21972 3. WebLogic RCE: CVE-2020-14882 Figure 9: Necro TerraMaster RCE scan code. Figure 10: Necro VMware vCenter Server RCE scan code. Figure 11: Necro WebLogic RCE scan code. Sniffer Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2. Figure 12 shows the sniffer code used in Tsunami and Gafgyt. You can see that the same set of code is used. Figure 12: Gafgyt sniffer code. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 9VIRUS BULLETIN CONFERENCE OCTOBER 2021 Figure 13 shows the sniffer code used by Necro. The code for this function can also be found on GitHub with similar open source code. Figure 13: Necro sniffer code. We can see that the data is reported on the same port 1337, and since Necro also uses the IRC protocol, we can see that Necro may share the same C2 as Tsunami. Although we did not analyse DarkIRC in depth, it is easy to see that Keksec wants to build a botnet management platform based on the IRC protocol that can infect all architectures and operating systems and can act as a unified management platform for botnet management. Disguising processes Change process name A very traditional technique on Linux systems is to use random strings to override argv parameters and prctl(PR_SET_ NAME,buf) to change the process name and start parameters in order to disguise the process. Figure 14: Code using prctl() to change the process name. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 10 VIRUS BULLETIN CONFERENCE OCTOBER 2021 Use of rootkit to hide process The open-source project r77 rootkit is used directly on Windows systems. It is a ring3 layer rootkit that intercepts and filters information about the target process by globally hooking some functions of ntdll.dll. Figure 15: r77 rootkit code to hook system APIs. Necro first downloads the corresponding version of the rootkit file, which is dynamically loaded and run directly in memory by process injection. Figure 16: Necro code to download r77 rootkit. Process injection Necro uses process injection to load the rootkit by wrapping the dll file into a shellcode and then injecting the whole shellcode into the process memory; the loading of the rootkit is done by the shellcode, which comes from an open-source project on GitHub named RDI. Figure 17: Necro code for injecting code into other process. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 11VIRUS BULLETIN CONFERENCE OCTOBER 2021 DGA In its historical versions Necro used DGA to evade C2 interception. The relevant algorithm is described below. Random The first algorithm is a purely random one that picks 16 characters at random from a custom alphabet to generate a C2 domain name with the top-level domain ‘xyz’. Because the seed of the random algorithm is fixed 0-3, the random number generated has a stable result. Figure 18: Necro random DGA algorithm. DDNS + random The second algorithm is based on the DDNS service, and the random algorithm picks 10 to 19 characters randomly from a custom alphabet. This method is cheaper and more flexible. Figure 19: Necro DDNS + random DGA algorithm. Tor We found Tor proxy being used to communicate with the C2 in both Gafgyt and Necro. Gafgyt In Gafgyt Tor proxy is used to talk to the C2 through a built-in proxy list. Up to 173 proxy IPs can be used for a single sample. Figure 20 shows Gafgyt’s Tor initialization code. A communication is established by randomly selecting one from the list of candidate proxies and if successful, a connection to the onion C2 will follow. Figure 21 shows the connecting code and Figure 22 shows captured Gafgyt onion communication data. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 12 VIRUS BULLETIN CONFERENCE OCTOBER 2021 Figure 20: Gafgyt Tor initialization code. Figure 21: Gafgyt Tor connecting code. Figure 22: The captured Gafgyt onion communication data. Necro Necro also uses Tor proxy to reach an onion C2, and IRC protocol is used for the C2 communication. Figure 23 shows the code Necro uses to contact the C2 with Tor. Figure 23: Necro code to contact C2 with Tor. THE KEKSEC BOTNETS WE OBSERVED IN THE PAST YEAR JIN & TU 13VIRUS BULLETIN CONFERENCE OCTOBER 2021 Obfuscation and packer UPX Most of the Gafgyt and Tsunami samples we captured were not packed and had no stripped symbolic information, while a few of the packed samples used the standard UPX shell, which can be removed directly using open-source tools. The unpacked samples were also not stripped. String encoding Gafgyt and Tsunami samples encrypt sensitive strings (such as C2 addresses) with a simple mapping algorithm, and encrypt them with the decode function when using strings. Figure 24: Gafgyt C2 decryption. This algorithm is also not developed by Keksec, it is used by a Tsunami variant called ziggystartux. In the early variants of Keksec this code table was identical to the one in the original ziggystartux code. Figure 25: Ziggystartux’s cipher code table. After several iterations this code table was changed to "'%q*KC)&F98fsr2to4b3yi_:wB>z=;k? "EAZ7.D-md