Supershell Malware Targeting Linux SSH Servers

• Short Summary: AhnLab SEcurity intelligence Center (ASEC) has identified an attack involving the Supershell backdoor on poorly managed Linux SSH servers. This backdoor, developed in Go by a Chinese-speaking developer, enables remote control of infected systems and is often accompanied by attempts to exploit weak passwords through dictionary attacks.

• Key Points:
  • Supershell is a backdoor malware that allows remote control of infected systems.
  • It is developed in the Go programming language and supports multiple platforms.
  • The malware was installed on inadequately managed Linux SSH servers.
  • The threat actor used dictionary attacks to gain access to systems.
  • Commands were executed to download and install Supershell from various sources.
  • There is a potential link to cryptocurrency mining, as Supershell may be used to install CoinMiners.
  • Recommendations for administrators include using strong passwords, regular updates, and security programs.

MITRE ATT&CK TTPs – created by AI

• Technique Name: Remote Access Software (T1219)
  • Supershell acts as a reverse shell, allowing remote control of infected systems.
• Technique Name: Credential Dumping (T1003)
  • Threat actors used dictionary attacks to attempt to log in to systems with weak passwords.
• Technique Name: Command and Scripting Interpreter (T1059)
  • Commands were executed to download and install Supershell using shell commands.
• Technique Name: Data Obfuscation (T1001)
  • The malware is obfuscated but can be identified through internal strings and behavior.
• Technique Name: Exfiltration Over Command and Control Channel (T1041)
  • Supershell allows the threat actor to control the infected system and potentially exfiltrate data.

AhnLab SEcurity intelligence Center (ASEC) has recently discovered an attack case installing the Supershell backdoor on inadequately managed Linux SSH servers. Created by a Chinese-speaking developer, Supershell is developed in the Go language and supports various platforms including Windows, Linux, and Android. Its primary function is a reverse shell, which allows a threat actor to remotely control an infected system.

Figure 1. GitHub page of Supershell

It is suspected that the threat actor installed a scanner after infecting multiple systems and then attempted to log in through dictionary attacks from the following attack sources. 

Table 1. Attack source addresses and credential information used during the login attempt process

After successfully carrying out the attack, the threat actor executed commands (see Table 2) to directly install Supershell or install a shell script that serves as a downloader. Supershell was downloaded not only through web servers but also via FTP servers.

Table 2. Commands identified in the attack case

The malware that is ultimately installed is obfuscated, but it can be identified as the Supershell backdoor through a few internal strings, its behavior, and the strings observed during its execution process.

Figure 2. Obfuscated Supershell

Figure 3. Log showing Supershell’s execution

In attacks targeting poorly managed Linux systems, it is common to see the installation of CoinMiners like XMRig or DDoS bots such as ShellBot and Tsunami. In the attack observed this time, the threat actor initially installed Supershell for control hijacking purposes. However, given that there are cases where XMRig Monero CoinMiners are also installed alongside Supershell, it appears that the attacker’s ultimate goal is to mine cryptocurrency.

Table 3. Threat actor’s Monero wallet address

Recently, Supershell has been installed on poorly managed Linux SSH servers. When the backdoor malware is installed, a Linux server can receive commands from the threat actor and be hijacked.

As such, administrators should use passwords that are difficult to guess for their accounts and change them periodically to protect the Linux server from brute force attacks and dictionary attacks, and update to the latest patch to prevent vulnerability attacks. Administrators should also use security programs such as firewalls for servers that are accessible from the outside to restrict access from threat actors. Finally, caution must be practiced by updating V3 to the latest version to block malware infection in advance.

Detection Names
Backdoor/Linux.CobaltStrike.3753120 (2024.09.11.00)
Downloader/Shell.Agent.SC203780 (2024.09.11.00)
Downloader/Shell.ElfMiner.S1705 (2021.11.29.02)

Source : https://asec.ahnlab.com/en/83232/