Xwo Botnet

Xwo is a Python-based botnet family that scans the internet for exposed web services and default passwords.

Threat ID:: CC-3018
Category:: Botnet
Threat Severity:: Medium
Threat Vector:: Download
Published:: 11 April 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Xwo is a Python-based botnet family that scans the internet for exposed web services and default passwords.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

It appears to share code with the MongoLock ransomware and Xbash worm, as well as using the same command and control (C2) infrastructure as MongoLock, although it does not have the same capabilities as either.

Xwo has recently been observed being hosted on a server, although at the time of publication it is not known how users are directed to download the malware.

When Xwo is executed, the affected device transmits a HTTP POST request to a C2 server that includes a user agent randomly selected from a hard-coded list. The C2 server then responds with instructions including an IP address range to scan. The affected device then scans this address range and collects information on available services, including default credentials, misconfigurations, default paths, repositories and remote file transfer tools. This information is then sent to the C2 server in another HTTP POST request.

Remediation steps

Type	Step
	Network administrators should ensure that default credentials are not used and that access controls are configured for services accessible from the internet. To prevent and detect a trojan infection, ensure that: A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

Network administrators should ensure that default credentials are not used and that access controls are configured for services accessible from the internet.

To prevent and detect a trojan infection, ensure that:

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 14 February 2020 2:54 pm