ESET researchers have spotted a new and improved version of Kaiten, an Internet Relay Chat (IRC)-controlled malware typically used to carry out distributed denial-of-service (DDoS) attacks. The remastered malware has been dubbed “KTN-Remastered” or “KTN-RM”, with three versions of Linux/Remaiten already identified by ESET researchers. Based on artifacts in the code, the main feature of the malware is an improved spreading mechanism.
Based primarily on Linux/Gafgyt’s telnet scanning, KTN-RM improves on that spreading mechanism by carrying downloader executable binaries for embedded platforms such as routers and other connected devices. Targeting mainly those with weak login credentials.
„Further, the downloader‘s job is to request the Linux/Remaiten bot binary from the Command & Control server for its current architecture. When executed, it also creates another bot for the malicious operators to use. We have seen this technique used before by Linux/Moose to spread infections,“ says Michal Malík, ESET Malware Researcher.
In a strange twist, this strain of malware also has a message for those who might try to neutralize its threat.
“Within the welcome message, version 2.0 seems to single out malwaremustdie.org which has published extensive details about Gafgyt, Tsunami and other members of this family of Malware,” adds up Malík.
Additional details about the Linux/Remaiten Bot can be found in a technical article by Michal Malik on ESET’s official security blog, WeLiveSecurity.com.
About ESET
Since 1987, ESET® has been developing award-winning security software that now helps over 100 million users to Enjoy Safer Technology. Its broad security product portfolio covers all popular platforms and provides businesses and consumers around the world with the perfect balance of performance and proactive protection. The company has a global sales network covering 180 countries, and regional offices in Bratislava, San Diego, Singapore and Buenos Aires. For more information visit www.eset.com or follow us on LinkedIn, Facebook and Twitter.