EburyMalware
This payload has been used to compromise kernel[.]org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials. This family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.From MISP Galaxy
Last reported yesterday, by SecurityWeek5 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1014Rootkit
“Start a shell with H=1 I=1 LD_PRELOAD=":" LD_DEBUG=":" bash to get past the userland rootkit before running Léveillé's updated script or the commands in Zimmer's post.”
- T1053Scheduled Task/Job
“…able hunts for each persistence mechanism; however, more details regarding the basics of threat hunting are outlined in the “Hunting for T1053 - scheduled task/job” section of “Linux Detection Engineering - A primer on persistence mechanisms”.”
- T1059.009Cloud API
“…ported records included TiDB Cloud user names and email addresses, customer contacts, contract and billing details, and encrypted TiDB Cloud API key values, though the company has found no evidence that data stored in TiDB was impacted.”
- T1218.002Control Panel
“…'s public-facing application, the AI agents pored through digital records to find associated infrastructure, located a public-facing control panel, discovered a subtle weakness in the way it processed data, and after hours of trial and error, reported leveraging it to trick the…”
- T1546Event Triggered Execution
“T1546.016 - Event Triggered Execution: Installer Packages”
- T1546.016Installer Packages
“T1546.016 - Event Triggered Execution: Installer Packages”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware“…ervers, which captured the passwords of users who ignored SSH’s warning and then tried to infect the servers they were logging into with Ebury.”
-
Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident“The attacker hacked Tor relays, infected them with the Ebury Linux malware, and converted them to exit relays where it could intercept SSH connections and downgrade email connections to steal unencrypted email traffic.”
-
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections“In kaba's honeypot, the installer took the same form as the command that put Ebury, a backdoor that hides inside OpenSSH, on one of a relay operator's servers, as described below.”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“The attacker hacked Tor relays, infected them with the Ebury Linux malware, and converted them to exit relays where it could intercept SSH connections and downgrade email connections to steal unencrypted email traffic.”
-
Linux Detection Engineering - Approaching the Summit on Persistence Mechanisms“This is a common technique, and some examples include the open-source Medusa and Azazel rootkits, and by malwares such as Ebury, and Skidmap to establish persistence, capture credentials, and maintain unauthorized access.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/Aegrah/PANIXin 1 report
- 9543f7ce4c6a8def…5a2d3f43383bin 1 report
- infosec[.]exchangein 1 report
- hexane[.]ccin 1 report
- colborne.bsky[.]socialin 1 report
- saskiabricmont.bsky[.]socialin 1 report
- 185.225.226[.]62in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.