An aggressive botnet operator has switched to SMB password brute-forcing to infect and propagate like a worm through the Microsoft Windows ecosystem, according to malware researchers at Guardicore.
Purple Fox, the malware campaign, has been operating since at least 2018, and the discovery of the latest worm-like infection vector is yet another indication that cybercriminals continue to benefit from consumer-grade malware.
Purple Fox operators mainly used exploit kits and phishing emails to create botnets for crypto-mining and other nefarious purposes, according to Guardicore researcher Amit Serper.
The new SMB brute-force approach is now being used in conjunction with rootkit capabilities to cover and propagate through internet-facing Windows computers with poor passwords.
Guardicore Global Sensors Network (GGSN) detected Purple Fox’s novel spreading technique through indiscriminate port scanning and exploitation of exposed SMB services with weak passwords and hashes between the end of 2020 and the beginning of 2021, according to Serper.
Serper said that in May 2020, there was a “huge amount of malicious activity,” with the number of infections increasing by 600 percent to a total of 90,000 attacks.
Serper’s blog, which includes IOCs to aid defenders in their quest for signs of infection, describes the malware operator’s aggressiveness:
“While it appears that the functionality of Purple Fox hasn’t changed much post exploitation, its spreading and distribution methods – and its worm-like behavior – are much different than described in previously published articles. Throughout our research, we have observed an infrastructure that appears to be made out of a hodge-podge of vulnerable and exploited servers hosting the initial payload of the malware, infected machines which are serving as nodes of those constantly worming campaigns, and server infrastructure that appears to be related to other malware campaigns.
The attackers are hosting various MSI packages on nearly 2,000 servers, according to Serper’s team at Guardicore, the majority of which are compromised computers that have been repurposed to host malicious payloads.
In a technical blog post, Guardicore said, “We have established that the vast majority of the servers serving the initial payload are running on relatively old versions of Windows Server running IIS version 7.5 and Microsoft FTP, which are known to have numerous vulnerabilities of varying severity levels.”
The company discovered that the campaign spreads by two different mechanisms: a worm payload after a victim computer is infected via a vulnerable exposed service (such as SMB); or the worm payload is transmitted via email through a phishing operation.
Malware hunters are encouraged to use public indicators of compromise to look for signs of malicious activity related to this threat, according to the company.
