Attacks with new Pumabot botnet hit Linux IoT devices

Internet of Things devices running on Linux have been targeted by the newly emergent PumaBot botnet in SSH brute-force attacks, according to Security Affairs.

After brute-forcing SSH credentials from retrieved IPs, the Go-based PumaBot botnet distributes itself and gathers system information while concealing its presence with a bogus systemd service before executing the XMRig cryptominer and the ddaemon and networkxm binaries, a report from Darktrace showed. Further analysis revealed PumaBot to be tracking traffic cameras and surveillance systems produced by Pumatronix, as well as conducting environment fingerprinting checks to bypass honeypots. "While [PumaBot] does not appear to propagate automatically like a traditional worm, it does maintain worm-like behavior by brute-forcing targets, suggesting a semi-automated botnet campaign focused on device compromise and long-term access," said Darktrace researchers, who urged organizations to defend themselves from the botnet by performing regular systemd service audits, tracking atypical SSH login patterns, and restricting port 22 exposure.