Water SigbinThreat actor

“Sekoia TDR observed an MS-SQL honeypot compromised by brute force within an hour, then used to deploy Mallox ransomware via PureCrypter.”

“The downloaded file, a shell script named "2.gif," is saved in the /tmp directory, employing a typical masquerading technique to bypass filename based detection.”

“The attacker enabled xp_cmdshell parameters to allow SQL Server to spawn a Windows command shell and pass in a string for execution.”

“Mallox use bcedit to inhibit system recovery.”

“PwnRig establishes persistence using cron jobs, and also leverages /etc/init.d/ and systemd services for maintaining persistence on infected systems even after reboots.”

“It is executed using the Reflective Code Loading technique by the previous payload.”