Type: Linux Trojan / DDoS botnet (rootkit-capable)
Quick Summary
First Seen / Known Since: First publicly reported in 2014 (discovered by MalwareMustDie).
Primary Targets / Industries: Linux servers, cloud instances, IoT devices, and container/Docker hosts.
Geographic Focus: Global; historically heavy activity in Asia and frequent targeting of US-based infrastructure in recent waves.
Infection & Distribution
Common Delivery Vectors: SSH brute-force / credential compromise, automated scanning of exposed services, malicious scripts dropped after initial access.
Initial Access Methods: Brute-force or stolen SSH credentials, exploitation of exposed management interfaces, automated deployment scripts.
Technical Characteristics
Platform / Language: Multi-architecture Linux ELF binaries (x86, x64, ARM); often accompanied by shell scripts for installation.
Persistence Mechanisms: Multiple-install-step approach including installing rootkit components, cron/jobs, service wrappers and use of scripts to re-deploy persistence across reboots.
Command & Control (C2): Encrypted communications often using simple XOR-based obfuscation; C2 infrastructure has evolved and includes resilient controller nodes and domain/IP patterns.
Capabilities: High-capacity volumetric DDoS (various UDP/TCP/HTTP flood techniques), remote command execution, bot management, and sometimes lateral scanning for new victims.
Evasion Techniques: XOR obfuscation of strings/traffic, rootkit hiding to conceal files/processes, multi-stage installers that complicate detection and attribution.
Notable Campaigns / Incidents
Historic wave (2014–2015): Large brute-force campaigns that initially brought XorDDoS to light.
Resurgence / recent waves (2019–2025): Periodic resurgences with improved controllers and infrastructure; researchers documented a notable wave and new controller activity between late 2023 and early 2025.
Impact Assessment
Damage Potential: Medium to High. Primarily contributes to large-scale DDoS campaigns; infected hosts are turned into bots and can cause significant service disruption or be rented/sold for DDoS-for-hire.
Typical Victim Impact: Service downtime, increased bandwidth costs, potential secondary compromises if credentials are reused.
Common Filenames / Paths: Often installs via /tmp or /var/tmp with temporary script names; look for suspicious shell scripts, unexpected cron entries, or kernel module artifacts.
YARA / Detection Snippets: Look for XOR-deobfuscation routines, ELF sections with suspicious strings obfuscated by XOR, or known command patterns from community rules.
Detection & Mitigation
Detection Tips: Monitor for high outbound DDoS traffic, sudden SSH login failures/successes (brute-force patterns), unexpected long-running ELF processes, hidden files/modules, and unusual cron/service entries.
Immediate Mitigation Steps: Isolate infected hosts from network, revoke SSH keys/passwords, rotate credentials, remove malicious persistence, patch exposed services, and restore from known-good images if rootkit compromise suspected.
Longer-term Recommendations: Harden SSH (disable password auth, use keys with MFA, rate-limit/geo-block where possible), apply least-privilege, enable host-based monitoring/EPP with rootkit detection, block known C2 domains/IPs at perimeter, and maintain IR playbooks for botnet infections.
