Gitpaste-12 Worm
First seen in October 2020, Gitpaste-12 is a worm that uses GitHub and Pastebin to store it's propagation and attack modules. Whilst it appears to still be in development it is already capable of opening reverse shells and installing other payloads.
Summary
First seen in October 2020, Gitpaste-12 is a worm that uses GitHub and Pastebin to store it's propagation and attack modules. Whilst it appears to still be in development it is already capable of opening reverse shells and installing other payloads.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Named for the fact it uses both GitHub and Pastebin, as well as 12 separate infection vectors, to compromise systems; Gitpaste-12 is worm and associated botnet targeting Linux-based servers and Internet-of-Things devices.
Propagation & activities
Gitpaste-12 propagates to new systems using a script which deploys 11 different exploits and a Telnet brute-force module against random /8 CIDR ranges. If successful, it drops another script which immediately downloads a cron job from Pastebin.
A shell script is then dropped on the target system to act as the loader for Gitpaste-12 proper. It first attempts to disable firewall rules, cloud security agents, and kernel security services like SELinux or AppArmor. It then connects to a GitHub repository to download Gitpaste-12 before executing it.
Once installed, Gitpaste-12 will connect to the same GitHub repository to download any new command scripts, cron jobs, or additional modules (including the exploit modules). At the time of publication, it has also been observed installing a cryptocurrency miner as well.
Threat updates
| Date | Update |
|---|---|
| 16 Dec 2020 |
New campaign spotted
A new Gitpaste-12 campaign has been identified using an updated version of the worm Believed to have begun in November, the new version of Gitpaste-12 used in this campaign contains 31 different exploits. |
Remediation advice
Both the GitHub repository and the PasteBin account used by Gitpaste-12 appear to have been disabled by the respective service owners, although it is likely that new repositories and accounts will be made to redistribute it in future.
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that the NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 18 January 2022 8:41 am