A new worm that is based on malicious software Mirai, attacks Linux devices and installs application miningof cryptocurrencies.
The new and previously unknown self-replicating malware attacks Linux devices around the world via a network called Noabot, and installs cryptomining malware while taking unusual steps to hide its inner workings.
The worm is a customized version of Mirai, a malware botnet that infects Linux-based servers, routers, webcams and other so-called IoT devices.
Mirai came to light in 2016 when it was used in a denial-of-service attack that paralyzed key parts of the internet that year.
The worm's creators released the source code after the attack, so several criminal groups from around the world incorporated Mirai into their own attack campaigns.
The new worm has just settled into a device Linux, uses it as a platform to infect other vulnerable devices (that's why it's called a worm), which means it's self-replicating.
Researchers from the company Akamai revealed that NoaBot has been targeting Linux devices since at least last January. Instead of targeting weak telnet passwords, NoaBot targets weak passwords connecting SSH connections.
The new botnet installs cryptocurrency mining software, which allows attackers to create digital currencies using computing resources, electricity and victims' bandwidth.
cryptominer is a modified version of XMRig, another piece of open source malware.
To date, the attacks originate from 849 distinct IP addresses, almost all of which likely host an already infected device.
