Pierluigi Paganini September 22, 2017

Experts at security firm Doctor Web discovered a new botnet of IoT devices leveraging the Linux.ProxyM, that is used by crooks for mass spam mailings.

The most popular thingbot since now is the Mirai, but it isn’t the only one targeting Linux-based internet-of-things (IoT) devices.

Researchers with security firm Doctor Web discovered a new botnet of IoT devices leveraging the Linux.ProxyM, that is used by crooks for mass spam mailings.

Experts first analyzed the Linux.ProxyM in July, it was used to create a proxy network through SOCKS proxy server on infected devices that are used to relay malicious traffic, disguising his real source.

The Trojan has been noted since February 2017 but peaked in late May as reported in the chart below.

According to Dr. Web, the number of devices infected with Linux.ProxyM reached 10,000 units in July since its discovery in February 2017.

Recently the Linux.ProxyM trojan has recently been updated to add mas spam sending capabilities to earn money.

“The number of malicious programs capable of infecting “smart” Linux devices is constantly increasing. A major portion of them is designed to mount DDoS attacks and ensure online anonymity. Research conducted by Doctor Web’s specialists has revealed that cybercriminals are using such Linux Trojans for mass mailings.” reads the analysis from Dr. Web.

The malware is capable of detecting honeypots in order to hide from malware researchers and can operate on almost any Linux device, including routers, set-top boxes, and other equipment.

Experts identified two builds of this Linux.ProxyM Trojan for devices based on x86, MIPS, MIPSEL, PowerPC, ARM, Superh, Motorola 68000, and SPARC architectures.

Once the Linux.ProxyM infects a device, it connects to a command and control (C&C) server and downloads the addresses of two Internet nodes, once providing a list of logins and passwords, the second

The C&C server also sends a command containing an SMTP server address, the credentials used to access it, a list of email addresses, and a message template, which contains advertising for various adult-content sites.

Below the content of the typical spam message spread by the infected devices:

Subject: Kendra asked if you like hipster girls
A new girl is waiting to meet you.
And she is a hottie!
Go here to see if you want to date this hottie
(Copy and paste the link to your browser)
http://whi*******today.com/
Check out sexy dating profiles
There are a LOT of hotties waiting to meet you if we are being honest!

The thingbot is very effective, on an average, each infected device can send out 400 of such emails per day.

“A C&C server sends a command to an infected device. The command contains an SMTP server address, the login and password used to access it, a list of email addresses, and a message template of itself. These emails contain advertising for various adult-content websites.” continues the analysis.

Doctor Web has no information about the total number of infected devices, the experts noted several Linux.ProxyM attacks launched during the past 30 days, most of the infected devices are located in Brazil and the US, followed by Russia, India, Mexico, Italy, Turkey, Poland, France and Argentina.