[ad_1]
An IRC (Web Relay Chat) bot pressure programmed in GoLang is getting used to launch distributed denial-of-service (DDoS) assaults focusing on customers in Korea.
“The malware is being distributed underneath the guise of grownup video games,” researchers from AhnLab’s Safety Emergency-response Middle (ASEC) mentioned in a brand new report printed on Wednesday. “Moreover, the DDoS malware was put in through downloader and UDP RAT was used.”
The assault works by importing the malware-laced video games to webhards — which refers to an internet exhausting drive or a distant file internet hosting service — within the type of compressed ZIP archives that, when opened, consists of an executable (“Game_Open.exe”) that is orchestrated to run a malware payload except for launching the precise recreation.
This payload, a GoLang-based downloader, establishes connections with a distant command-and-control (C&C) server to retrieve further malware, together with an IRC bot that may carry out DDoS assaults.
“It’s also a sort of DDoS Bot malware, nevertheless it makes use of IRC protocols to speak with the C&C server,” the researchers detailed. “In contrast to UDP Rat that solely supported UDP Flooding assaults, it may well additionally assist assaults similar to Slowloris, Goldeneye, and Hulk DDoS.”
GoLang’s low improvement difficulties and its cross-platform assist have made the programming language a well-liked alternative for menace actors, the researchers added.
“The malware is being distributed actively through file sharing web sites similar to Korean webhards,” AhnLab mentioned. “As such, warning is suggested when approaching executables downloaded from a file-sharing web site. It’s advocate[ed] for the customers to obtain merchandise from the official web sites of builders.”
[ad_2]
