IoT botnet dropper script
Fallout in linux, Jul 27 – Aug 2
What we caught this week while monitoring over 167,389,056 artifacts across 46 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 2 · 38 catches · 1 wave · 3 singlesbotnet/iotdelivery/download-execute
SATURDAY
Sat Aug 1 · 53 catches · 3 waves · 3 singlesHTTP desync probe in dependency
depends on hostile gem: http_parser.rb v0.6.0-javapackage/rubygems
WEDNESDAY
Wed Jul 29 · 15 catches · 0 waves · 3 singlesTUESDAY
Tue Jul 28 · 70 catches · 9 waves · 3 singlesMalware dropper killing processes and downloading payloads
Installs SSH backdoor via raw IP
Malicious dropper downloading and executing payloads
delivery/download-execute
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories