Romanian-Based Cryptojacking Group Brute-Forces Linux Passwords
A gang of hackers focused on cryptojacking and believed to operate out of Romania is using a brand new brute-force password hack tool and attacking Linux-based systems. The group's tool is called Diicot Brute and has never been encountered before by security researchers.
The Diicot Brute tool is a SSH password brute-forcer that attempts to crack weak, poorly constructed passwords on Linux machines. Once the hackers gain entry, they deploy a cryptominer that works with the Monero cryptocurrency.
The practice of cryptojacking is not particularly new. Hackers have been using malicious tools focused on cryptocurrency to obtain illegal profit for years now. Cryptojacking refers to bad actors stealthily deploying a malicious cryptomining tool on a victim's machine and then using the victim's hardware and resourced to mine currency that goes into the hacker's wallet.
Of course, using someone else's hardware is much cheaper than setting up a dedicated crypto farm and paying exorbitant electricity bills, so enterprising hackers are always on the lookout for easy money using their victim's computers.
According to researchers, the Diicot Brute tool claims it has the ability to detect and avoid hotbeds. Judging by the fact that it was caught in just one such hotbed testing environment seems to indicate that Diicot still has some work to do.
The cryptomalware's connection to Romania comes from its interface - Diicot Brute has an interface that is presented in part Romanian, part English.
The hackers also use Discord for reporting information back to them. This is an increasingly common occurrence, with several other malware campaigns in the past few months using Discord's infrastructure to help illegal activities.
The way the malware works is, it first sniffs out SSH servers using port scanning. Next up is the actual brute forcing step, running until valid credentials are found. Finally, the malware connects using the cracked credentials using SSH and then deploys its cryptomining payload.
The discouraging bottom line from the security report on the Romanian hackers is that the reason why their tool works is simply "people". Even though the Linux community is famous for its obsessive-compulsive behavior when it comes to security, there are obviously still plenty of weak passwords that allow similar brute force kits to work.
