NTRG_ElasticBotnetReport_06102015

While the Elknot malware does not have direct file management or process management
functionality, it would still be possible for the attackers responsible for the C2 servers that house
the local privilege exploits to introduce these binaries on a victim’s machine using the exact same
Elasticsearch vulnerability that led to the initial infection. However, for those using the BillGates
malware, it would be a simple matter to download, decompress and execute the exploit packages
thanks to the malware’s remote shell functionality.
The use of such old exploits, the automated manner by which the Elasticsearch exploitation was
performed, and the lack of observed lateral movement indicates that the actors involved with the
construction of the DDoS botnet have little real interest in data theft, but rather resource theft.
Moreover, the actors appear to have little more than “script-kiddie” skill levels as the tools being
used by the actors are easily acquired and meant to be deployed practically off the shelf, requiring
almost no customization for a victim’s machine. Regardless of the actors’ skill level, the fact that the
Elasticsearch vulnerability is so easily exploited means that very little skill is necessary to develop a
large-scale DDoS infrastructure.
The lack of operational technical skill is also mirrored in the lack of operational security demonstrated
by the actors, which has been highlighted previously in MMD’s analyses of this malware. As Novetta
observed with Delilah, the use of HFS instances provides a fast means for sharing content, but it
also reveals information such as the number of times a particular file has been downloaded, which
in turn reveals how pervasive a particular actor is. It was also not uncommon to find additional, nonattack
related files within the HFS instance. For example, one particular actor routinely shared out
what appeared to be a Legends of Mir game server. Additionally, one of the HFS instances frequently
would share out text files containing brute force password dictionaries, lists of Elasticsearch instances
that have been compromised, and a list of server IP addresses with their respective usernames and
passwords. By crawling the various open HFS instances seen by the Delilah attack alerts, Novetta
was able to capture roughly 70 files in addition to the 48 files found within the Elasticsearch attacks.
Collectively, the nearly 120 files provide a wealth of information on the attacker’s motivations, tools,
and practices.
8. DETECTION/REMEDIATION STRATEGIES
Clearly the first remediation activity that an administrator should perform is to apply the necessary
patches to their Elasticsearch instances on a continual basis. While this will not remediate existing
infections, it will prevent an uninfected instance from succumbing to the current threat. Along these
same lines, it would be advisable for any Elasticsearch instance that does not need direct access by
any individual on the Internet to have a firewall in place to prevent such access.
Removal of the Elknot malware is a simple matter of rebooting the victim server. There is no
persistence included within Elknot, therefore merely rebooting the server will flush the infection. This
being said, a forensic analysis of the victim server should be performed as other malware, unrelated
to Elknot, may have been introduced via the Elasticsearch vulnerability.
Administrators can use the following two YARA signatures to detect the presence of the Elknot
payload and its dropper on an infected host:
THE ELASTIC BOTNET REPORT
59