Public-private partnership unveils the full scale of a sophisticated Linux threat
summary
Public‑private forensics tie seized physical servers to a long‑running Linux botnet called Ebury revealing compromised ~400k Linux hosts over 15 years, four distinct SSH takeover methods including an OpenSSH credential exfiltration backdoor, userland rootkits, ARP‑spoofing against crypto nodes and compromised data‑center subnets via ARP spoofing. A rented honeypot is breached in seven days, internal logs list victims and monetization (spam, web‑redirects, card/info‑stealers), and published detection tools and mitigations demonstrate workable defenses.
AI-written summary · about
chapters (14)
- 0:00Linux botnet research intro
- 3:11ESET telemetry uncovered threat
- 5:18Windigo Linux botnet discovery
- 9:15Botnet monetization tactics
- 11:06Tracking operator to Finland arrest
- 14:23Servers seized revealing scale
- 17:31Timeline and new attack methods
- 19:42Honeypot testing botnet reach
- 21:51Cryptocurrency theft via ARP spoofing
- 23:38Host key bypass security tricks
- 25:43Exfiltration and modern monetization
- 26:50Malware eviction and script analysis
- 27:50Detection and prevention tools
- 29:38Summary and contact info
related talks
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
39mReal-World Detection Evasion Techniques in the Cloud
12mCatch-22: Uncovering Compromised Hosts using SSH Public Keys
52mInvestigating DDOS - Architecture Actors and Attribution
39mHow to think like a hacker
24mAll I Know About Cybersecurity I Learned from Fungus
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
50mThe Anatomy of Cloud Attacks