Originating in 2020 and coded in Go, the BlueShell backdoor operates stealthily, utilizing TLS encryption to avoid network detection while communicating with its command-and-control (C2) server. It relies on three key configuration parameters: the C2 server’s IP address, port number, and a specified waiting time. Research has linked the use of BlueShell malware to the Dalbit Group, a threat actor based in China known for targeting Windows systems to pilfer critical data for ransom demands. The group has also been implicated in attacks against mail servers and MS-SQL database servers.
Introduction of the New Variant:
Recent analysis of BlueShell’s behavior in Linux environments uncovered a customized variant of the malware on VirusTotal. Notably, this variant was uploaded from locations in Korea and Thailand, suggesting these regions may have been targeted in the attack.
Recent Operating System Attacks:
A threat actor is exploiting vulnerabilities in the MinIO Object Storage system to execute arbitrary code remotely on vulnerable servers, impacting both Linux and Windows environments through specific Downloader Scripts. Additionally, an evolved SkidMap malware variant was observed targeting various Linux distributions, including Alibaba, Anolis, and RedHat, in early August. The same month saw the emergence of a new hVNC tool for hacking Mac systems, enabling attackers to gain remote control and steal sensitive information discreetly.
Key Takeaways:
ASEC’s report underscores the increasing prevalence of BlueShell malware across Windows, Mac, and Linux systems in Korea and Thailand. To counter such threats, organizations should prioritize routine system patching, deploy robust intrusion detection systems, and fortify server security measures. Furthermore, educating users on identifying phishing attempts can significantly mitigate the risk of malware infections.