Malware Shellbot is Now Capable of Shutting Down Other Miners

The Shellbot cryptojacking malware has gone through an update and come out with some new capabilities, technology news website TechCrunch reported on May 1.

Per the report, these findings come from Boston-based cybersecurity firm Threat Stack. The company claims that Shellbot, which was first discovered in 2005, has received a major update.

The original Shellbot was capable of brute-forcing the credentials of SSH remote access services on Linux servers protected by weak passwords. The malware then mines privacy-focused monero (XMR). Threat Stack claims that this new-and-improved version is capable of spreading through an infected network and shutting down other miners running on the same machines.

Threat Stack apparently uncovered the new iteration of Shellbot on the Linux server of an unspecified United States company. While it is still unclear how the malware is delivered, the researchers identified three components and found the script used to install it.

The command and control server of the malware is an Internet Relay Chat (IRC) server, which attackers can use to deliver commands and check the status of an infected server. Shellbot was reportedly making about $300 a day, a figure that stands to grow as the malware spreads. Sam Bisbee, chief security officer at Threat Stack, told TechCrunch that the potential of the virus does not end there:

“They are fully capable of using this malware to exfiltrate, ransom, or destroy data.”

As Cointelegraph reported last week, cybersecurity company MalwareBytes declared illicit crypto mining  against consumers — also known as cryptojacking — “essentially extinct.”

Just days later, American software security firm Symantec found a spike in a new crypto mining malware that mainly targets corporate networks.