10-Year-Old ‘RUBYCARP’ Romanian Hacker Group Surfaces with Botnet

A menace team of suspected Romanian origin known as RUBYCARP has been noticed sustaining a prolonged-running botnet for carrying out crypto mining, distributed denial-of-company (DDoS), and phishing attacks.

The group, thought to be energetic for at minimum 10 years, employs the botnet for economical get, Sysdig said in a report shared with The Hacker News.

“Its main method of operation leverages a botnet deployed making use of a wide variety of public exploits and brute-power attacks,” the cloud security business claimed. “This team communicates by using community and private IRC networks.”

Proof gathered so much implies that RUBYCARP might have crossover with yet another threat cluster tracked by Albanian cybersecurity company Alphatechs less than the moniker Outlaw, which has a heritage of conducting crypto mining and brute-drive assaults and has considering that pivoted to phishing and spear-phishing strategies to cast a huge net.

“These phishing e-mails frequently entice victims into revealing sensitive info, this kind of as login credentials or monetary particulars,” security researcher Brenton Isufi claimed in a report printed in late December 2023.

A noteworthy element of RUBYCARP’s tradecraft is the use of a malware identified as ShellBot (aka PerlBot) to breach concentrate on environments. It has also been noticed exploiting security flaws in the Laravel Framework (e.g., CVE-2021-3129), a approach also adopted by other risk actors like AndroxGh0st.

In a indicator that the attackers are expanding their arsenal of initial accessibility strategies to broaden the scale of the botnet, Sysdig reported it discovered indications of WordPress internet sites becoming compromised employing typically employed usernames and passwords.

“Once access is received, a backdoor is installed primarily based on the well-known Perl ShellBot,” the firm mentioned. “The victim’s server is then connected to an [Internet Relay Chat] server acting as command-and-management, and joins the greater botnet.”

The botnet is estimated to comprise about 600 hosts, with the IRC server (“chat.juicessh[.]pro”) developed on May well 1, 2023. It intensely depends on IRC for standard communications as properly as for taking care of its botnets and coordinating crypto mining strategies.

Also, members of the team – named juice_, Eugen, Catalin, MUIE, and Smecher, among many others – have been discovered to converse via an Undernet IRC channel referred to as #cristi. Also place to use is a mass scanner tool to obtain new potential hosts.

RUBYCARP’s arrival on the cyber risk scene is not shocking supplied their means to choose benefit of the botnet to gasoline varied illicit income streams these types of as crypto mining and phishing operations to steal credit rating card figures.

While it seems that the stolen credit score card facts is employed to obtain attack infrastructure, there is also the probability that the information could be monetized as a result of other indicates by marketing it in the cyber crime underground.

“These menace actors are also included in the development and sale of cyber weapons, which is just not very popular,” Sysdig explained. “They have a significant arsenal of equipment they have built up around the years, which offers them pretty a variety of versatility when conducting their functions.

Identified this write-up intriguing? Stick to us on Twitter  and LinkedIn to go through a lot more unique content material we submit.

Some parts of this article are sourced from:
thehackernews.com