ebury-is-alive-but-unseen.pdf

(eset):research

WHITEPAPER

Marc-Etienne M.Léveillé

May 2024

Ebury is alive but unseen:

400k Linux servers compromised for cryptocurrency

theft and financial gain

ESET | EBURY IS ALIVE BUT UNSEEN WHITEPAPER | 2

Contents

Propagation� 7

Credential stuffing� 8

Hypervisor or container host� 9

Compromise of hosting providers� 9

Exploitation of vulnerabilities� 9

SSH adversary-in-the-middle� 10

Victimology� 11

Notable compromises� 13

An Update to Ebury� 15

Ebury basics� 16

Persistence� 17

IPC mechanisms� 18

libcurl hooking for HTTP request exfiltration� 19

Userland rootkit� 19

Typical post-exploitation usage� 22

Credential exfiltration� 22

Monetization: Multiple New Components� 23

Malicious Apache and nginx modules� 24

KernelRedirect� 29

FrizzySteal� 31

Hiding traffic…