{"id":123835,"date":"2024-05-15T22:14:33","date_gmt":"2024-05-15T16:44:33","guid":{"rendered":"https:\/\/www.techworm.net\/?p=123835"},"modified":"2024-05-15T22:14:33","modified_gmt":"2024-05-15T16:44:33","slug":"ebury-botnet-infested-linux-server","status":"publish","type":"post","link":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html","title":{"rendered":"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising"},"content":{"rendered":"

Botnets come in handy for malicious attackers who conduct cybersecurity attacks.<\/p>\n

Ebury is one such botnet malware that has been troubling Linux servers since 2009.<\/p>\n

Even after fifteen years, it remains in existence, evolving and using new tactics.<\/p>\n

ESET researchers published a new report<\/a> describing how malware infects a server and the measures to prevent it from spreading further.<\/p>\n

What\u2019s Ebury Botnet Malware, and What Is Its Impact?<\/strong><\/h2>\n

Ebury botnet malware steals credentials from the compromised servers. It is designed purely for monetary gain because sensitive data can be sold on the dark web or used to blackmail affected server admins.<\/p>\n

In 15 years, Ebury successfully infiltrated over 400K Linux servers. That isn\u2019t a small number, but ESET says that only 25 percent are compromised.<\/p>\n

That means nearly 100K servers are still infected and unaware of Ebury\u2019s presence.<\/p>\n

\u201cThe perpetrators keep track of the systems they compromised, and we used that data to draw a timeline of the number of new servers added to the botnet each month,\u201d said ESET.<\/p>\n

Ebury\u2019s Evolving<\/strong><\/h3>\n

Even after the creator of botnet malware was arrested in 2017, it continued to spread. ESET regularly deploys honeypots to lure Ebury\u2019s into infecting themselves and studying the malware.<\/p>\n

But over time, the honeypots have become inept at reacting to Ebury\u2019s infection. In one such incident, the malware brazenly sent a \u201cHello ESET honeypot\u201d message.<\/p>\n

The malware is improving at identifying honeypots, making it more difficult for researchers.<\/p>\n

Ebury loves targeting hosting providers because they open gates to multiple servers. Rather than going after one server, capturing and snooping on multiple servers appeals to them.<\/p>\n

ESET rented a virtual server, and Ebury infected it in less than a week.<\/p>\n

Hackers also love intercepting traffic and redirecting users to servers that capture credentials.<\/p>\n

Cryptocurrency nodes are prime targets because they gain access to wallet credentials and then transfer the money.<\/p>\n

The malware is exceptionally good at covering tracks. It uses new obfuscation techniques to hide from the admin\u2019s eyes.<\/p>\n

The Dutch National High Tech Crime Unit (NHTCU) and ESET collaborated after finding malware on the server of a victim of cryptocurrency theft.<\/p>\n

To learn more about the malware, check out the official research paper<\/a>. You can also try an Ebury detection script<\/a> that is available on GitHub.<\/p>\n","protected":false},"excerpt":{"rendered":"

Botnets come in handy for malicious attackers who conduct cybersecurity attacks. Ebury is one such botnet malware that has been troubling Linux servers since 2009. Even after fifteen years, it remains in existence, evolving and using new tactics. ESET researchers published a new report describing how malware infects a server and the measures to prevent […]<\/p>\n","protected":false},"author":80,"featured_media":123836,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,3],"tags":[63091,7311,6772],"class_list":{"0":"post-123835","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-hacking","8":"category-security-and-hacking-news","9":"tag-ebury","10":"tag-linux-malware","11":"tag-malware"},"yoast_head":"\n400,000 Linux Servers Infected by Ebury Botnet & Cases Rising » TechWorm<\/title>\n<meta name=\"description\" content=\"ESET researchers published a report describing how Ebury malware infects a server and prevention measures.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising\" \/>\n<meta property=\"og:description\" content=\"Botnets come in handy for malicious attackers who conduct cybersecurity attacks. Ebury is one such botnet malware that has been troubling Linux servers\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\" \/>\n<meta property=\"og:site_name\" content=\"TechWorm\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/techworm.in\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-15T16:44:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Abhishek\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Techworm_in\" \/>\n<meta name=\"twitter:site\" content=\"@Techworm_in\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\"},\"author\":{\"name\":\"Abhishek\",\"@id\":\"https:\/\/www.techworm.net\/#\/schema\/person\/28799722b5b49566ce6ce245bf479734\"},\"headline\":\"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising\",\"datePublished\":\"2024-05-15T16:44:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\"},\"wordCount\":389,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.techworm.net\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg\",\"keywords\":[\"ebury\",\"Linux Malware\",\"Malware\"],\"articleSection\":[\"Hacking\",\"Hacking News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#respond\"]}],\"copyrightYear\":\"2024\",\"copyrightHolder\":{\"@id\":\"https:\/\/www.techworm.net\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\",\"url\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\",\"name\":\"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising » TechWorm\",\"isPartOf\":{\"@id\":\"https:\/\/www.techworm.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg\",\"datePublished\":\"2024-05-15T16:44:33+00:00\",\"description\":\"ESET researchers published a report describing how Ebury malware infects a server and prevention measures.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage\",\"url\":\"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg\",\"contentUrl\":\"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg\",\"width\":1200,\"height\":675,\"caption\":\"Ebury Botnet on lInux\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.techworm.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hacking\",\"item\":\"https:\/\/www.techworm.net\/category\/hacking\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.techworm.net\/#website\",\"url\":\"https:\/\/www.techworm.net\/\",\"name\":\"TechWorm\",\"description\":\"The Tech Hub\",\"publisher\":{\"@id\":\"https:\/\/www.techworm.net\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.techworm.net\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.techworm.net\/#organization\",\"name\":\"Techworm\",\"url\":\"https:\/\/www.techworm.net\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techworm.net\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.techworm.net\/wp-content\/uploads\/2019\/12\/TECHWORM-FOOTER-LOGO.png\",\"contentUrl\":\"https:\/\/www.techworm.net\/wp-content\/uploads\/2019\/12\/TECHWORM-FOOTER-LOGO.png\",\"width\":300,\"height\":64,\"caption\":\"Techworm\"},\"image\":{\"@id\":\"https:\/\/www.techworm.net\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/techworm.in\",\"https:\/\/x.com\/Techworm_in\",\"https:\/\/www.instagram.com\/techworm_in\/\",\"https:\/\/www.linkedin.com\/company\/9221219\",\"https:\/\/www.youtube.com\/channel\/UCpa9W_3YE1c9Iu4j2ifxzsg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.techworm.net\/#\/schema\/person\/28799722b5b49566ce6ce245bf479734\",\"name\":\"Abhishek\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/d3b7aca40a9046a3bc3204981fe9c9e02d877c361edeccbdf686fb0c67f2d479?s=96&d=wavatar&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d3b7aca40a9046a3bc3204981fe9c9e02d877c361edeccbdf686fb0c67f2d479?s=96&d=wavatar&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d3b7aca40a9046a3bc3204981fe9c9e02d877c361edeccbdf686fb0c67f2d479?s=96&d=wavatar&r=g\",\"caption\":\"Abhishek\"},\"url\":\"https:\/\/www.techworm.net\/author\/abhishek\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising » TechWorm","description":"ESET researchers published a report describing how Ebury malware infects a server and prevention measures.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html","og_locale":"en_US","og_type":"article","og_title":"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising","og_description":"Botnets come in handy for malicious attackers who conduct cybersecurity attacks. Ebury is one such botnet malware that has been troubling Linux servers","og_url":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html","og_site_name":"TechWorm","article_publisher":"https:\/\/www.facebook.com\/techworm.in","article_published_time":"2024-05-15T16:44:33+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg","type":"image\/jpeg"}],"author":"Abhishek","twitter_card":"summary_large_image","twitter_creator":"@Techworm_in","twitter_site":"@Techworm_in","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#article","isPartOf":{"@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html"},"author":{"name":"Abhishek","@id":"https:\/\/www.techworm.net\/#\/schema\/person\/28799722b5b49566ce6ce245bf479734"},"headline":"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising","datePublished":"2024-05-15T16:44:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html"},"wordCount":389,"commentCount":0,"publisher":{"@id":"https:\/\/www.techworm.net\/#organization"},"image":{"@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage"},"thumbnailUrl":"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg","keywords":["ebury","Linux Malware","Malware"],"articleSection":["Hacking","Hacking News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#respond"]}],"copyrightYear":"2024","copyrightHolder":{"@id":"https:\/\/www.techworm.net\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html","url":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html","name":"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising » TechWorm","isPartOf":{"@id":"https:\/\/www.techworm.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage"},"image":{"@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage"},"thumbnailUrl":"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg","datePublished":"2024-05-15T16:44:33+00:00","description":"ESET researchers published a report describing how Ebury malware infects a server and prevention measures.","breadcrumb":{"@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#primaryimage","url":"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg","contentUrl":"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg","width":1200,"height":675,"caption":"Ebury Botnet on lInux"},{"@type":"BreadcrumbList","@id":"https:\/\/www.techworm.net\/2024\/05\/ebury-botnet-infested-linux-server.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.techworm.net\/"},{"@type":"ListItem","position":2,"name":"Hacking","item":"https:\/\/www.techworm.net\/category\/hacking"},{"@type":"ListItem","position":3,"name":"400,000 Linux Servers Infected by Ebury Botnet & Cases Rising"}]},{"@type":"WebSite","@id":"https:\/\/www.techworm.net\/#website","url":"https:\/\/www.techworm.net\/","name":"TechWorm","description":"The Tech Hub","publisher":{"@id":"https:\/\/www.techworm.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.techworm.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.techworm.net\/#organization","name":"Techworm","url":"https:\/\/www.techworm.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techworm.net\/#\/schema\/logo\/image\/","url":"https:\/\/www.techworm.net\/wp-content\/uploads\/2019\/12\/TECHWORM-FOOTER-LOGO.png","contentUrl":"https:\/\/www.techworm.net\/wp-content\/uploads\/2019\/12\/TECHWORM-FOOTER-LOGO.png","width":300,"height":64,"caption":"Techworm"},"image":{"@id":"https:\/\/www.techworm.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/techworm.in","https:\/\/x.com\/Techworm_in","https:\/\/www.instagram.com\/techworm_in\/","https:\/\/www.linkedin.com\/company\/9221219","https:\/\/www.youtube.com\/channel\/UCpa9W_3YE1c9Iu4j2ifxzsg"]},{"@type":"Person","@id":"https:\/\/www.techworm.net\/#\/schema\/person\/28799722b5b49566ce6ce245bf479734","name":"Abhishek","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d3b7aca40a9046a3bc3204981fe9c9e02d877c361edeccbdf686fb0c67f2d479?s=96&d=wavatar&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3b7aca40a9046a3bc3204981fe9c9e02d877c361edeccbdf686fb0c67f2d479?s=96&d=wavatar&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3b7aca40a9046a3bc3204981fe9c9e02d877c361edeccbdf686fb0c67f2d479?s=96&d=wavatar&r=g","caption":"Abhishek"},"url":"https:\/\/www.techworm.net\/author\/abhishek"}]}},"jetpack_featured_media_url":"https:\/\/www.techworm.net\/wp-content\/uploads\/2024\/05\/Ebury-Botnet-is-Alive-and-Kicking-Infested-400k-Linux-Servers-in-15-Years.jpg","_links":{"self":[{"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/posts\/123835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/users\/80"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/comments?post=123835"}],"version-history":[{"count":0,"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/posts\/123835\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/media\/123836"}],"wp:attachment":[{"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/media?parent=123835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/categories?post=123835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techworm.net\/wp-json\/wp\/v2\/tags?post=123835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}