Ankura CTIX FLASH Update - November 18, 2022

Ransomware/Malware Activity

RapperBot Malware Campaign Conducts DDoS Attacks Against Video Game Servers

Researchers at Fortinet have recently identified new samples of the "RapperBot" malware in a campaign launching distributed denial-of-service (DDoS) attacks against game servers. This campaign is similar to an older campaign beginning in February 2022 and "mysteriously disappeared in the middle of April." The new RapperBot samples were first identified in August 2022 and are known to "exclusively brute-force SSH servers configured to accept password authentication." The newest samples have the capability to perform Telnet brute-forcing as well as supporting denial-of-service (DoS) attacks. This is done by using the Generic Routing Encapsulation (GRE) tunneling protocol as well as by using UDP floods to target game servers. This is facilitated by hard-coding lists of default IoT credentials in plaintext which are embedded within the Telnet brute-forcing