Shellbot Remote Access Trojan

First observed in 2005, Shellbot is a remote access trojan primarily used as a backdoor and downloader for other malware. Despite its age, Shellbot continues to be a popular choice for threat actors and is now being used in cryptocurrency mining campaigns against Drupal web servers.

Shellbot is distributed using exploits for two Drupal vulnerabilities to gain access; CVE-2018-7600 (also known as Drupalgeddon 2.0) and CVE-2018-7602. Potentially vulnerable websites are first identified using automated scans, before the exploits are deployed to gain access to the underlying server.

Once this is done, Shellbot will use CVE-2018-7600 to escalate its privileges before connecting to a command and control server over IRC. It will then detect and terminate all cryptocurrency mining applications on the server before installing it’s own miner. Shellbot is also able to use the infected server in spam and phishing campaigns, to perform distributed denial-of-service attacks and to scan for new devices to infect.

For further information:

• CVE-2018-7600
• CVE-2018-7602

Resolution

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Duncan

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.