Over 10000 Unix Servers Infected With Trojan, 500,000 Computers At Risk Daily

A widespread cybercriminal campaign has seized control of over 25,000 Unix servers worldwide, reported ESET. Dubbed as “Operation Windigo”, this malicious campaign has been going on for years and uses a nexus of sophisticated malware components that are designed to hijack servers, infect the computers that visit them, and steal information.

ESET security researcher Marc-Étienne Léveillé says:

“Windigo has been gathering strength, largely unnoticed by the security community, for over two and a half years, and currently has 10,000 servers under its control. Over 35 million spam messages are being sent every day to innocent users’ accounts, clogging up inboxes and putting computer systems at risk.  Worse still, each day over half a million computers are put at risk of infection, as they visit websites that have been poisoned by web server malware planted by Operation Windigo redirecting to malicious exploit kits and advertisements.”

Of course, it’s money

The purpose of Operation Windigo is to earn money through:

• Spam
• Infecting web users’ computers through drive-by downloads
• Redirecting web traffic to advertisement networks

Apart from sending spam emails, websites running on infected servers attempt to infect visiting Windows computers with malware via an exploit kit, Mac users are served adverts for dating sites and iPhone owners are redirected to pornographic online content.

Does it mean it does not infect desktop Linux? I cannot say and report mentions nothing about it.

Inside Windigo

ESET published a detailed report with the team’s investigations and malware analysis along with guidance to find if a system is infected and instructions to recover it. As per the report, Windigo Operation consists of the following malware:

• Linux/Ebury: runs mostly on Linux servers. It provides a root backdoor shell and has the ability to steal SSH credentials.
• Linux/Cdorked: runs mostly on Linux web servers. It provides a backdoor shell and distributes Windows malware to end users via drive-by downloads.
• Linux/Onimiki: runs on Linux DNS servers. It resolves domain names with a particular pattern to any IP address, without the need to change any server-side configuration.
• Perl/Calfbot: runs on most Perl supported platforms. It is a lightweight spam bot written in Perl.
• Win32/Boaxxe.G: a click fraud malware, and Win32/Glubteta.M, a generic proxy, run on Windows computers. These are the two threats distributed via drive-by download.

Check if your server is a victim

If you are a sys admin, it could be worth checking if your server is a Windingo victim. ETS provides the following command to check if a system is infected with any of the Windigo malware:

$ ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo “System clean” || echo “System infected”

In case your system is infected, you are advised to wipe affected computers and reinstall the operating system and software. Hard luck but it is to ensure safety.