A financially motivated operation is actively targeting vulnerable SSH servers with the covert objective of incorporating them into a proxy network without detection.
According to Akamai researcher Allen West's report released on a Thursday, this ongoing campaign involves the attacker exploiting SSH for remote access. They execute malicious scripts, surreptitiously enrolling victim servers into a peer-to-peer (P2P) proxy network, such as Peer2Profit or Honeygain.
In contrast to cryptojacking, where compromised systems are hijacked to mine cryptocurrency unlawfully, proxyjacking provides threat actors with the means to utilize the victim's unused bandwidth discreetly to operate various services as a P2P node.
This approach yields two significant advantages. Firstly, it allows the attacker to monetize the surplus bandwidth with considerably less resource demand than cryptojacking would entail. Secondly, it minimizes the likelihood of detection.
Allen West characterizes this technique as a more covert alternative to cryptojacking, emphasizing its potential to compound the challenges already posed by Layer 7 attacks that employ proxies.
Adding to the complexity, the anonymity offered by proxyware services has a dual nature. It can be exploited by malicious actors to obscure the origin of their attacks by routing traffic through intermediary nodes.
Akamai, which first identified this recent campaign on June 8, 2023, has revealed that its primary objective is to infiltrate vulnerable SSH servers. The attackers employ a covert tactic by deploying an obfuscated Bash script. This script is designed to retrieve essential components from a compromised web server, including a camouflage technique that disguises the curl command-line tool as a CSS file labeled "csdark.css."
The surreptitious script goes even further by actively seeking and terminating any competing instances of bandwidth-sharing programs. Afterward, it initiates Docker services to harness the victim's bandwidth for financial gain.
A deeper inspection of the compromised web server has unveiled an additional layer of illicit activity – it is hosting a cryptocurrency miner. This suggests that the threat actors are involved in both cryptojacking and proxyjacking schemes.
While proxyware itself is not inherently malicious, Akamai has pointed out that "some of these companies fail to properly validate the origin of the IPs in their networks and occasionally encourage users to install the software on their work computers."
However, these operations can cross the line into cybercrime territory when applications are installed on users' systems without their knowledge or consent. This grants the threat actor control over multiple systems, enabling them to generate illicit revenue.
Akamai researcher West emphasizes the ongoing effectiveness of traditional security practices, such as using strong passwords, maintaining up-to-date patch management, and maintaining meticulous logs, as key preventive measures against these threats.