The Bitxor20 Botnet Abuses the Log4J Vulnerability
The Log4J vulnerability has enabled dozens of cybercriminals to rapidly expand their reach, and amplify the efficiency of their attacks. One of the malware families that flew under the radar so far, has been the Bitxor20 Botnet. This malware is compatible with devices using the Linux ARM architecture. The criminals behind the Bitxor20 Botnet may have been active for nearly two months, and during this period their payload has undergone numerous improvements.
What can the Bitxor20 Botnet Do?
The botnet specializes in exfiltrating sensitive data from infected systems, deploying rootkits, and turning the infected networks into proxy servers. The rootkit functionality is certainly an interesting approach since it would make the discovery and removal of the Bitxor20 Botnet much more challenging. Furthermore, there aren't many rootkits compatible with Linux systems.
Another cool perk of the Bitxor20 Botnet is its ability to transfer data between the victim and the Command-and-Control server via the DNS protocol. While this limits the amount of information it can transfer, it enables the criminals to easily conceal the malicious traffic with a legitimate one. Furthermore, firewall services tend to be far more relaxed when it comes to filtering DNS requests – giving Bitxor20 Botnet an advantage when it comes to bypassing firewall defenses.
While most botnets exploiting the Log4J vulnerability specialized in Distributed-Denial-of-Service (DDoS) attacks or cryptocurrency mining, the Bitxor20 Botnet has its sights set elsewhere. Needless to say, it is an exceptionally dangerous threat that should be stopped at any cost. Using up-to-date Linux security & firewall tools, as well as applying the latest firmware updates and software patches is a great way to mitigate malware attacks of this sort.
