Card Image 1

Emma Johnson

Age 19, Hookup

Card Image 2

Sophia Martinez

Age 22, Single

Card Image 3

Isabella Davis

Age 21, Single

Card Image 4

Mia Garcia

Age 19, Searching

Card Image 5

Olivia Rodriguez

Age 21, Available

Card Image 6

Ava Hernandez

23, Single

Card Image 7

Emily Lopez

Single & Searching

Card Image 8

Charlotte Gonzalez

18, Single

Card Image 9

Amelia Wilson

21, Boys & Girls

Card Image 10

Harper Anderson

Accept any gender

Card Image 1

Emma Johnson

Age 19, Hookup

Card Image 2

Sophia Martinez

Age 22, Single

Card Image 3

Isabella Davis

Age 21, Single

Card Image 4

Mia Garcia

Age 19, Searching

Card Image 5

Olivia Rodriguez

Age 21, Available

Card Image 6

Ava Hernandez

23, Single

Card Image 7

Emily Lopez

Single & Searching

Card Image 8

Charlotte Gonzalez

18, Single

Card Image 9

Amelia Wilson

21, Boys & Girls

Card Image 10

Harper Anderson

Accept any gender

Thousands of Linux servers infected by Ebury malware

Thousands of Linux servers infected by Ebury malware

Thousands of Linux servers are still infected by Ebury, a decades-old information-stealing malware that was thought extinct.

Ebury is a sophisticated piece of malware designed to compromise Linux-based systems, particularly servers. It’s a type of backdoor and credential-stealing malware that allows attackers to gain unauthorized access to compromised systems.

Ebury’s developers are financially motivated, in newer times expanding into the cryptocurrency space, as well. Ebury also seems to be used for spam and web traffic redirection.

Targeting hosting providers

When cybersecurity researchers from ESET first reported on Ebury a decade ago, the report resulted in the arrest of the malware’s operators. However, that didn’t stop the malware from being updated and growing in the years since. Cumulatively, since 2009, some 400,000 Linux-powered servers have been infected by this backdoor. 

At the end of last year, more than 100,000 endpoints were thought to still carrying the infection, according to a follow-up report (PDF) that ESET published earlier this week.

Key Ebury victims seem to be hosting providers, the researchers found. “The gang leverages its access to the hosting provider’s infrastructure to install Ebury on all the servers that are being rented by that provider,” they explained. As part of an experiment, they rented a virtual server and suffered an infection within a week. 

“Another interesting method is the use of adversary in the middle to intercept SSH traffic of interesting targets inside data centers and redirect it to a server used to capture credentials,” they added.

Last year, more than 200 servers were targeted by Ebury operators. Among the targets were many Bitcoin and Ethereum nodes, as one of Ebury’s main features was to automatically steal cryptocurrency wallets hosted on the targeted server, as soon as the victim logs in with a password.

Via BleepingComputer

More from TechRadar Pro

Leave a Reply

Your email address will not be published. Required fields are marked *