Skip to main content

DemonBot DDoS Botnet

DemonBot is a newly observed distributed denial-of-service (DDoS) botnet. It actively targets unsecured Apache Hadoop servers via a misconfiguration in Hadoop's YARN ("Yet Another Resource Negotiator") component.
Threat ID:
CC-2754
Category:
Botnet
Threat Severity:
Low
Threat Vector:
Exploit
Published:
30 October 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

DemonBot is a newly observed distributed denial-of-service (DDoS) botnet. It actively targets unsecured Apache Hadoop servers via a misconfiguration in Hadoop's YARN ("Yet Another Resource Negotiator") component.

Threat details

DemonBot supports UDP and TCP floods as DDoS attack vectors.

The threat actors operating DemonBot are scanning the internet for Hadoop installations with misconfigured YARN modules. Attackers are actively exploiting a remote code execution vulnerability to access internal YARN APIs that are exposed to external connections. DDoS-capable malware strains can then be deployed inside Hadoop server clusters.

At the time of publication, DemonBot does not appear to be performing any malicious activity on infected devices. It is probable that the threat actors operating the botnet are attempting to limit discovery and analysis as it continues to grow.

Remediation steps

Type Step

Users and administrators should review their YARN configurations immediately and make any appropriate changes.

To avoid devices becoming part of a botnet, organisations should:

  • Review the network security of devices on the estate.
  • Change any device default usernames and passwords.

To protect against a distributed denial-of-service (DDoS) attack, organisations should ensure:

  • They have suitable DDoS mitigation tools.
  • They have a suitable DDoS mitigation plan in place.

Should an organisation suspect it is subject to an active DDoS attack, they should ensure that every effort is made to stop the attack and restore service. However, care should be taken to ensure that the attackers are not using the DDoS attack as a distraction whilst other, potentially more sensitive, systems are exploited. Monitoring of critical systems is recommended, including the use of host-based intrusion prevention and detection systems (HIPS/HIDS) where appropriate.

Last edited: 17 February 2020 12:41 pm