KmsdBot is malware that carries out DDoS attacks and cryptocurrency mining activities by accessing targeted systems using the SSH cryptographic network protocol.
KmsdBot malware is distributed on systems with weak SSH credentials.
KmsdBot malware has the ability to perform scanning activities on targeted systems, spread to different systems through username and password combinations and run cryptocurrency mining. In addition, the malware carries out DDoS attacks that use generic Layer 4 and Layer 7 traffic to strain the targeted server resources and hinder the server’s ability to process and respond.
In the cryptocurrency mining malware campaign called KmsdBot, threat actors have targeted gaming, luxury car and security companies, as reported by Security Affairs. In this context, in order not to be targeted by the related malware campaign;
- Use public key authentication for SSH connections,
- Not using weak or default credentials for servers or deployed applications,
- Do not open attachments/links from suspicious-looking sender e-mail addresses,
- Beware of unreliable content,
- Use of up-to-date and comprehensive security solutions,
- Keeping systems and applications up to date,
It is strongly recommended that IoC fin dings related to the attack campaign are blocked by security solutions.