Skip to main content

Chalubo DDoS Botnet

Chalubo (also referred to as ChaCha-Lua-Bot) is a newly observed Lua-based trojan targeting Linux systems to enrol into a distributed denial-of-service (DDoS) botnet.
Threat ID:
CC-2746
Category:
Botnet
Threat Severity:
Medium
Threat Vector:
Insecure network
Published:
25 October 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Chalubo (also referred to as ChaCha-Lua-Bot) is a newly observed Lua-based trojan targeting Linux systems to enrol into a distributed denial-of-service (DDoS) botnet.

Affected platforms

The following platforms are known to be affected:

Linux

Linux-based systems using the following micro-architectures:

  • 32- and 64-bit ARM
  • x86
  • x64
  • MIPS
  • PowerPC

Threat details

It is able to infect systems using a wide variety of architectures, including Intel, ARM and PowerPC.

The threat actors operating Chalubo are using brute force attacks or default credentials to gain access to target devices. Once this is done, they issue several commands to close or suspend security- and encryption-related services before executing a loader module. This module spawns several crontab entries to maintain persistence before downloading the ChaCha-encrypted Chalubo payload. This is then decrypted and installed.

Once installed, Chalubo will connect to command and control server before downloading a secondary Lua script detailing the target IP address and type of DDoS attack to perform. At the time of publication, only SYN flood DDoS attacks have been observed, although Chalubo appears to be capable of a wider range of attacks.

Remediation advice

To avoid devices becoming part of a botnet, organisations should:

Remediation steps

Type Step
  • Review the network security of devices on the estate.
  • Change any device default usernames and passwords.

To prevent and detect a trojan infection, ensure that:

  • A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
  • All operating systems, anti-virus and other security products are kept up-to-date.
  • Regular anti-virus and security scans are performed on your organisation’s estate.
  • All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
  • Strong password policies are in place.
  • Network, proxy and firewall logs should be monitored for suspicious activity.
  • User accounts accessed from affected devices should be reset on a clean computer.
  • Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

To protect against a distributed denial-of-service (DDoS) attack, organisations should ensure:

Should an organisation suspect it is subject to an active DDoS attack, they should ensure that every effort is made to stop the attack and restore service. However, care should be taken to ensure that the attackers are not using the DDoS attack as a distraction whilst other, potentially more sensitive, systems are exploited. Monitoring of critical systems is recommended, including the use of host-based intrusion prevention and detection systems (HIPS/HIDS) where appropriate.

Last edited: 17 February 2020 12:39 pm