Custom malware Kaiji targets IoT devices via SSH brute forcing | Threat Intelligence

Kaiji spreads via SSH brute forcing by targeting root users.
Since it requires packet crafting capability, which can be executed only via a root user, it only targets the root user.

After establishing an SSH connection, it executes a bash script to set up the environment for the malware.
Then a /usr/bin/lib directory is created.
And the malware is installed under the filename ‘netstat’, ‘ps’, ‘ls’, or some other system tool name.
Once executed, Kaiji gets copied to /tmp/seeintlog and launches a second instance that initiates its operations. The implants’ operations consist of 13 central goroutines.
The doLink routine, decrypts the C2 address and registers the infected server with a command server.
It then launches the doTask and RotKit goroutines.
The main_doTask routine fetches commands from the C2, including:
- DDoS instructions
- SSH bruteforce instructions, including host range and a password to attempt login
- Run shell command
- Replace C2 servers
- Delete itself and remove all persistence
To carry out a DDoS attack, it retrieves an attack technique and a target, including:
- Two TCPFlood implementations (one with raw sockets)
- Two UDPFlood implementations (one with raw sockets)
- IPSpoof attack
- SYNACK attack
- SYN attack
- ACK attack
The ddos_Rotkit routine tries to connect to known hosts via SSH RSA keys or IPs found in bash history.

The malware installs persistence through rc.d and Systemd services:

main_runghost: Installs persistence through /etc/profile.d (/etc/profile.d/linux.sh)
main_rundingshi: Installs persistence through crontab
main_runganran: Backdoor for the SSH init script /etc/init.d/ssh to call the rootkit on startup
main_runshouhu: Copies the rootkit to /etc/32679, and runs it every 30 seconds.
main_runkaiji: Installs more persistence init.d files, e.g.: /etc/init.d/boot.local
ddos_rdemokill: Periodically checks the CPU and kills it if it is > 85%.