How Can You Protect Your Linux Infrastructure From XorDdos Malware

Microsoft has recently published a study on XorDdos malware. The report alarms a drastic rise in the activities of XorDdos malware. According to the report shared by Microsoft, there has been a surge of 254% in the past six months. This shows there is a worst waiting to happen. So, it’s time to learn about the XorDdos malware, its capabilities, infection method, detection, and the most important protection tips. Since the malware targets Linux-based operating systems deployed on cloud infrastructures and Internet of Things (IoT) devices, it is important to protect your Linux infrastructure from XorDdos malware.

Let’s see how to protect your Linux infrastructure from XorDdos malware in this post.

About the XorDdos Malware:

The XorDdos malware is a type of malicious software that is designed to launch distributed denial-of-service (DDoS) attacks. The malware was first discovered in 2014 by the research group MalwareMustDie, and has since been used in a number of high-profile DDoS attacks, including against KrebsOnSecurity, OVH, and Dyn. The malware was named XorDdos as it was active in denial of service activities on Linux infrastructure with the use of XOR function for encrypted communication with its command and control servers.

XorDdos Malware’s Initial Infection Method:

XorDdos malware predominantly targets Secure Shell (SSH) logins. Since SSH is the most commonly used protocol used by administrators for remote access because it allows encrypted communications over insecure networks. XorDdos initially tries to brute force the targets to gather valid login credentials. Once it has valid SSH keys, then it runs a script with root privileges to download and install XorDdos malware on the target device.

The study report describes two of XorDdos’ methods for initial access. The first method involves copying a malicious ELF file to temporary file storage /dev/shm and then running it. Later the files written to the /dev/shm will be deleted during system restart for covert operation.

In the second access method, the malware executes a bash script that performs the below actions.

2. Once it identifies the writable directory, it changes to that directory and then downloads the ELF file payload from an external domain ‘hxxp://Ipv4PII_777789ffaa5b68638cdaea8ecfa10b24b326ed7d/1[.]txt‘ using curl command and saves the downloaded file as ygljglkjgfg0.

3. Then the malware makes it executable using the ‘chmod’ command and then executes it. The full technical details are published at this URL, and please visit the post for the original report.

How Can You Protect Your Linux Infrastructure From XorDdos Malware?

There are a number of steps you can take to protect your Linux infrastructure from XorDdos malware:

Microsoft created a Microsoft 365 Defender query for advanced detections. Run this query in Microsoft Defender Security Center to hunt the malware:

DeviceLogonEvents
| where InitiatingProcessFileName == "sshd"
    and ActionType == "LogonFailed"
| summarize count() by dayOfYear = datetime_part("dayOfYear", Timestamp)
| sort by dayOfYear
| render linechart

IoCs of XorDdos Malware:

Please see the captured IoCs of XorDdos malware:

File information

Dropped files

Download URLs