July 24, 2019 By David Bisson 2 min read

Researchers spotted an attack campaign that seeks out publicly exposed Elasticsearch databases and servers to deliver a distributed denial-of-service (DDoS) botnet.

In an attack wave spotted by Trend Micro, the DDoS botnet campaign began by scanning for exposed or unsecured Elasticsearch databases and servers. One instance of the attack even went so far as to exploit CVE-2015-1427, an older vulnerability that affects the Groovy scripting engine of Elasticsearch. Either way, the campaign used a dropper to run the script s67.sh so it could define which shell to use and where to find it before attempting to stop the firewall. The campaign then ran s66.sh, a second-stage script that removed traces of the initial infection and killed any other cryptocurrency mining processes before downloading the final binary.

The campaign’s binaries revealed a backdoor variant that functioned similarly to BillGates malware. Researchers observed this threat stealing system information, enslaving infected machines and launching DDoS attacks. The backdoor also came with the ability to exploit CVE-2017-5638, a remote code execution (RCE) vulnerability in Apache Struts 2.

A Growing List of Elasticsearch Security Incidents

This isn’t the first attack to prey on exposed Elasticsearch databases and servers. In November 2018, for instance, HackenProof unearthed an IP with a publicly accessible Elasticsearch cluster that exposed the personal data of nearly 57 million U.S. citizens. Two months later, Security Discovery observed an unprotected Elasticsearch server containing 24 million records of personal information.

Most recently, in April 2019, The Hacker News reported on tens of thousands of exposed Kibana instances that, in turn, made the Elasticsearch databases and servers with which they worked publicly accessible.

How to Defend Against a DDoS Botnet

Security professionals can help defend against attack campaigns that seek to deliver a DDoS botnet by using a comprehensive vulnerability management program to prioritize software patches based on the level of risk posed by known security weaknesses. Companies should also work to defend their systems against DDoS attacks using next-generation firewalls, anomaly detection and other tools.

More from

The straight and narrow — How to keep ML and AI training on track

3 min read - Artificial intelligence (AI) and machine learning (ML) have entered the enterprise environment.According to the IBM AI in Action 2024 Report, two broad groups are onboarding AI: Leaders and learners. Leaders are seeing quantifiable results, with two-thirds reporting 25% (or greater) boosts to revenue growth. Learners, meanwhile, say they're following an AI roadmap (72%), but just 40% say their C-suite fully understands the value of AI investment.One thing they have in common? Challenges with data security. Despite their success with AI…

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today