The Latest Gorilla Botnet Unleashes Over 300,000 DDoS Attacks Across 100 Global Regions
A group of cybersecurity experts has uncovered a fresh botnet malware strain named Gorilla (also known as GorillaBot) which is a modified version of the leaked Mirai botnet source code.
NSFOCUS, a cybersecurity company that detected this activity last month, mentioned that the botnet “executed more than 300,000 assault instructions, displaying an astonishing assault density” from September 4 to September 27, 2024. An average of 20,000 instructions intended for launching distributed denial-of-service (DDoS) strikes were dispatched from the botnet each day.
Reportedly, the botnet has launched assaults on over 100 nations, targeting educational institutions, government portals, telecommunications services, financial institutions, as well as the gaming and wagering sectors. Notably, China, the United States, Canada, and Germany have emerged as the most heavily targeted regions.
It was revealed that the Gorilla botnet mainly deploys UDP flood, ACK BYPASS flood, Valve Source Engine (VSE) flood, SYN flood, and ACK flood techniques for executing DDoS onslaughts. The botnet utilizes the connectionless aspect of the UDP protocol to engage in random source IP spoofing and generate substantial traffic volumes.
In addition to supporting different CPU architectures like ARM, MIPS, x86_64, and x86, the botnet is equipped with capabilities to connect to one of the five predefined command-and-control (C2) servers to receive DDoS directives.
Interestingly, the malware incorporates functionalities to exploit a security vulnerability in Apache Hadoop YARN RPC for remote code execution. Notably, this weakness has been exploited in the wild as early as 2021, as noted by Alibaba Cloud and Trend Micro.
Persistence on the host system is established by creating a service file dubbed custom.service in the “/etc/systemd/system/” directory and configuring it to launch automatically during system boot-up.
The service is responsible for downloading and executing a shell script (“lol.sh”) from a remote server (“pen.gorillafirewall[.]su”). Similar commands are injected into “/etc/inittab,” “/etc/profile,” and “/boot/bootcmd” files to fetch and run the shell script during system boot or user login.
“It introduced various DDoS attack methods and used encryption algorithms commonly employed by the Keksec group to conceal crucial details, in addition to employing multiple strategies to retain extended control over IoT devices and cloud hosts, showcasing a high degree of evasion techniques as an emerging botnet family,” as stated by NSFOCUS.
About Author
