From the Front Lines | 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts

Originally published by SentinelOne here.

Written by Tom Hegel, SentinelOne.

Over the last month a crimeware group best known as 8220 Gang has expanded their botnet to roughly 30,000 hosts globally through the use of Linux and common cloud application vulnerabilities and poorly secured configurations. In a recent campaign, the group was observed making use of a new version of the IRC botnet, PwnRig cryptocurrency miner, and its generic infection script.

8220 Gang is one of the many low-skill crimeware gangs we continually observe infecting cloud hosts and operating a botnet and cryptocurrency miners through known vulnerabilities and remote access brute forcing infection vectors. While the group has operated for years, by mid 2021, the botnet was observed operating with roughly 2000 hosts globally. This month, we observed new campaigns utilizing long-running sets of infrastructure, bringing the botnet numbers up to today’s figure of around 30,000 infected hosts.

Who Are the 8220 Gang?

8220 Gang, also known as 8220 Mining Group, was first publicly reported by Talos in 2018. The name 8220 Gang comes from the group’s original use of port 8220 for C2 network communications. The group has evolved somewhat from their original interests and the use of “WhatMiner”, which was forked from another group known as Rocke. The targeting of Docker, Hadoop, Redis, Drupal, and other services has been a continuing trend since their first discovery. Based on Talos’ discovery of Github repository details and infrastructure, the group is believed to be a Chinese-speaking threat actor.

Victims of 8220 Gang are typically, but not exclusively, users of cloud networks operating vulnerable and misconfigured Linux applications and services. Attacks make use of SSH brute forcing post-infection to automate local and global spreading attempts. Victims using cloud infrastructure (AWS, Azure, GCP, Aliyun, QCloud) are often infected via publicly accessible hosts running Docker, Confluence, Apache WebLogic, and Redis. Victims are not targeted geographically, but simply identified by their internet accessibility. At the time of writing, roughly 30,000 systems globally have been potentially infected with the 8220 Gang botnet.

8220 Cloud Botnet Infection Script

The infection script acts as the main code for the botnet to operate. Despite its lack of detection evasion or obfuscation, the script appears to be highly effective at infecting targets. The core functionality of the script has been widely reported on for a number of years as it has been reused by many amateur cryptocurrency mining groups and profit-seeking individuals. For that reason, researchers must be wary of attributing the script in its entirety to 8220 Gang.

We can summarize the script’s actions into the following buckets:

1. Victim host preparation and cleanup, including the removal of common cloud security tools.
2. IRC Botnet malware and miner download/configuration and remediation persistence.
3. Tsunami IRC Botnet malware sample validation and connectivity.
4. Internal network SSH scanner with lateral spreading capability.
5. PwnRig cryptocurrency miner execution.
6. Local SSH key collection, connectivity testing, and lateral spreading.

The script is notoriously ugly and often contains unused or outdated functions, allowing trivial tracking over time.

New and Old SSH Scanning Functions

8220 Gang and other groups who make use of this same infection script can be observed changing it multiple times a month. In late June 2022, the group began making use of a separate file they call “Spirit” to manage some of the SSH brute forcing functionality outside of the script. Spirit contains a list of approximately 450 hardcoded credentials for SSH brute forcing. The list includes combinations of the root username, and default Linux device and application passwords.

Another evolution example is the use of block lists. 8220 Gang and others make use of block lists in the infection script to avoid infecting specific hosts, such as researcher honeypots, which may place their illicit efforts at risk. The method of implementing the block list has shifted from direct IPs listed in the script to a list in an additionally-downloaded file. The method of calling the list in the script varies across implementations.

Example of blocklist functionality in recent infection scripts

What we can conclude is that the trivial design of the script allows for simple attacker experimentation, and it should not surprise researchers when specific functionality is added or reorganized.

Updated PwnRig Miner

PwnRig is a custom version of the open source XMRig miner that gained its name based on strings the author used in its early versions. More recent versions of PwnRig continue to make use of the same author name, while some functionality of the miner has been updated.

PwnRig Miner Execution Options – XMRig Variant

One of the notable features of PwnRig is the fake pool request for government domains. Early 2021 versions made use of fbi.gov; however, the latest version uses fbi.gov.br and 161.148.164.31. While the FBI subdomain is not real, the IP address is the active IP hosting the gov.br domain – the true Brazil federal government domain.

Conclusion

Over the past few years 8220 Gang has slowly evolved their simple, yet effective, Linux infection scripts to expand a botnet and illicit cryptocurrency miner. From our observations the group has made changes over the recent weeks to expand the botnet to nearly 30,000 victims globally. PwnRig, the IRC Botnet, and generic infection script are all incredibly simple and used opportunistically in the groups targeting.

Indicators of Compromise