New Gorilla Botnet Deploys Over 300,000 DDoS Attacks Worldwide
Reportedly, cybersecurity scholars have unearthed a newly identified botnet virus known as Gorilla (or GorillaBot), which is a mutation of the exposed Mirai botnet source code.
A definitive report by cybersecurity enterprise NSFOCUS outlined that this botnet “dispatched in excess of 300,000 assault directives, showing alarming density” from September 4 to September 27, 2024. An approximate of 20,000 assault directives were orchestrated daily to initiate distributed denial-of-service (DDoS) attacks.
As per the analysis, the botnet targeted beyond 100 countries, launching assaults on educational institutions, governmental portals, telecommunications, banking institutions, as well as the gaming and betting sectors. Notably, China, the United States, Canada, and Germany were prominently victimized.
The firm based in Beijing noted that Gorilla predominantly relies on UDP flood, ACK BYPASS flood, Valve Source Engine (VSE) flood, SYN flood, and ACK flood methodologies for executing DDoS operations. Furthermore, the botnet leverages the connectionless attributes of the UDP protocol to generate substantial traffic through arbitrary source IP spoofing.
In addition to supporting diverse CPU structures like ARM, MIPS, x86_64, and x86, this botnet possesses the capacity to connect to one of five preconfigured command-and-control (C2) servers to await DDoS directives.
Interestingly, the malicious software integrates functionalities to exploit a security loophole present in Apache Hadoop YARN RPC for executing remote code. It is important to note that this vulnerability has been exploited in real-world scenarios as early as 2021, as reported by Alibaba Cloud and Trend Micro.
Establishing persistence on the host involves creating a service file named custom.service within the “/etc/systemd/system/” directory and configuring it to initiate automatically on every system boot-up.
This service is responsible for downloading and executing a shell script (“lol.sh”) from a remote server (“pen.gorillafirewall[.]su”). Similar directives are also inserted into “/etc/inittab,” “/etc/profile,” and “/boot/bootcmd” files to download and activate the shell script upon system boot or user login.
“The botnet introduced multiple DDoS methodologies and utilized encryption algorithms commonly linked with the Keksec group to obscure vital details, along with deploying multiple strategies to maintain sustained control over IoT devices and cloud servers, showcasing a high level of evasion towards detection as an evolving botnet lineage,” stated NSFOCUS.
About Author
