IPStorm botnet attacks Android, macOS and Linux devices

[Brother]

For the first time, the IPStorm botnet was noticed by Anomali specialists in June 2019, and then it attacked only Windows machines. At that time, the botnet included about 3,000 infected systems, but even then the researchers discovered several unique and interesting features that are unique to IPStorm. For example, the full name of the malware - InterPlanetary Storm - comes from the InterPlanetary File System (IPFS), a P2P protocol that malware used to communicate with infected systems and transmit commands.

In addition, IPStorm turned out to be written in the Go language, and although no one is surprised with malware in this language, in 2019 this was not so widespread, which made IPStorm a rather exotic and interesting piece of malware.

Interestingly, Anomali's 2019 report did not explain how the malware spreads. At that time, some researchers hoped that IPStorm would turn out to be someone's experiment with IPFS and would not receive full development. Alas, these hopes were not destined to come true.

In recent reports published by experts Bitdefender and Barracuda, it is said that new versions of IPStorm have been discovered that can infect devices running Android, macOS and Linux. Experts also figured out how the botnet was spread, refuting the theory that it was just someone's experiment. Even worse, the number of infected machines has already increased to 13,500 hosts.

According to the researchers, the botnet attacks and infects Android devices by scanning the Internet for devices with an open ADB (Android Debug Bridge) port. In turn, devices running Linux and macOS are compromised through dictionary attacks on SSH, that is, attackers simply brute-force a username and password.

After IPStorm infiltrates devices, the malware checks for honeypot software, attaches itself to the system, and then eliminates a number of processes that could pose a threat to its operation.

Although the botnet has been active for over a year, researchers still haven't figured out what the ultimate goal of the IPStorm operators is. The fact is that IPStorm installs a reverse shell on all infected devices, but then leaves the systems alone. In theory, this backdoor can be abused in many ways, but so far IPStorm operators do not use it at all, although they could install miners on infected devices, use them as proxies, organize DDoS attacks, or simply sell access to infected systems.