FreakOut Botnet
First seen in early January, FreakOut is a Python-based botnet targeting several recent vulnerabilities to propagate.
Summary
First seen in early January, FreakOut is a Python-based botnet targeting several recent vulnerabilities to propagate.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
FreakOut (also known as Necro Python and Necromorph) is a newly observed botnet targeting Windows and Linux systems. Written in Python, it uses exploits for several recent vulnerabilities in NAS systems and web applications to propagate.
Propagation & activities
New FreakOut targets are identified using port scanning, with randomly generated IP ranges. It then attempts to gain access to new targets using a combination of brute-force attacks and its embedded exploits, If successful, FreakOut connect to a command and control server before dropping the XMrig cryptocurrency miner on the system. A new instance of its port-scanning utility is initiated, along with a packet sniffer so that FreakOut can perform ARP cache poisoning attacks.
The FreakOut botnet is also sold to third-parties for use in distributed denial-of-service attacks. At the time of publication, it is able to perform SlowLoris attacks as well as DNS, HTTP, and SYN floods.
Threat updates
| Date | Update |
|---|---|
| 9 Jun 2021 |
FreakOut botnet updated with additional exploits and now targeting Windows systems
Freak Out has been updated with additional exploits enabling it to propagate by targeting the following vulnerable platforms:
In addition to targeting Linux-based systems, FreakOut now targets Windows systems, gaining access via the vulnerabilities listed or stolen SSH credentials. It runs a PowerShell script on the exploited system to download and launch the FreakOut payload, along with an accompanying Python distribution. FreakOut achieves persistence by copying the Python distribution executable to USERPROFILE\\$6829.exe and creates a registry value to ensure the FreakOut runs when the user logs into the system. It uses a variant of r77-rootkit to evade detection, which terminates FreakOut if it detects an analysis environment and hides processes and registry values by modifying ntdll.dll functions. The Linux variant of FreakOut has added a JavaScript based cryptocurrency miner which it downloads by injecting JavaScript code into script-based files. It scans the system for files with HTM, HTML, JS or PHP into which it injects code to download and run a miner loader from a command and control (C2) server. The JavaScript also provides additional functionality to receive commands from the C2 server, enabling it to steal data from the clipboard, log keystrokes and launch denial-of-service attacks on the target. Unlike Linux variants of FreakOut, the Windows variant of does not have cryptocurrency mining functionality. |
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
CVE Vulnerabilities
Last edited: 9 June 2021 2:19 pm