While botnets have been used for anything from performing DDoS attacks to stealing data and even sending spam, Researchers have found signs that the Interplanetary Storm botnet could be used for different purposes
This Golang-written botnet could be used as an anonymization proxy-network-as-a-service and potentially rented using a subscription-based model.
While the botnet has come under previous scrutiny, constant monitoring of the development lifecycle of Interplanetary Storm has revealed that threat actors are both proficient in using Golang and development best practices, and well-versed at concealment of management nodes.
Interplanetary Storm also has a complex and modular infrastructure designed to seek and compromise new targets, push and synchronize new versions of the malware, run arbitrary commands on the infected machine and communicate with a C2 server that exposes a web API.
IPStorm propagates by attacking Unix-based systems (Linux, Android and Darwin) that run Internet-facing SSH servers with weak credentials or unsecured ADB servers.
Key findings:
- Botnet potentially rented as an anonymous proxy network
- Built to use compromised devices as proxies
- Botnet mapping reveals global presence
- Rented using multi-tier subscription-based pricing model
- More than 100 code revisions to date
- Detailed analysis of the infrastructure behind the Interplanetary Storm botnet
