Elknot

Elknot is a backdoor Trojan that uses the infected system for launching DDoS attacks for crashing third-party servers. Elknot may achieve installation directly through a threat actor or with the help of another threat, such as Linux/DDoSMan. Like all Trojans with backdoor-related features, this program is a high-level security risk and only dedicated anti-malware solutions should remove Elknot from an infected system.

Trojans Finding New Ways of Twisting You into Knots

Five years after its detection by initial reports from the Russian cyber-security industry, Elknot is both strong and evolving. This Denial-of-Service-specializing Trojan is creatable from kits, just like the more intuitive Ransomware-as-a-Service industry, and, as a result, is being exploited by multiple threat actors for different campaigns at any given time. The newest variant, first caught by a research team, even compromises systems with the help of a 'cohort,' Linux/DDoSMan.

A standard build of Elknot includes a self-checking component that restarts the Trojan, if it isn't running, every sixty seconds. Elknot also transmits some system information to its C&C server for the threat actor's monitoring and abuse, although it has no spyware features, such as password collecting, by default. Instead, it focuses on Denial-of-Service or DDoS attacks for crashing Web servers, which it can conduct through DNS querying, ICMP, SYN, TCP, UDP, and other tactics.

Besides all of the above, malware analysts can reaffirm Elknot's possibility of including features for giving a remote attacker more control over the system, such as executing shell commands, as well as replacing system tools with itself. However, the Linux/DDoSMan variant of Elknot appears dedicated to the DDoSing functionality. The majority of Elknot's targets for its core purpose of DDoS consist of gaming businesses throughout Asia, but regarding infections spreading to the 'zombie' systems, many Trojans' botnets, like the associated Linux/DDoSMan's ELF botnet, are opportunistic infectors.

Saving Your PC from a Digital Elk

Elknot (or, by its less-popular alias, the BillGates malware) can use as many distribution exploits as there are criminals who are willingly abusing its Trojan-generation toolkit. Overall, however, malware experts can point out some statistically probable modes of distribution:

• The threat actors maintaining Linux/DDoSMan and its variant of Elknot rely on port-scanning, which victims can defend themselves against with appropriate firewall rulesets, conservative port configurations, and updated server infrastructure.
• Brute-forcing login credentials can give criminals an opening for installing any form of Trojan or other threat that they prefer, and are blockable by avoiding simple or default passwords.
• There are occasional reports of Elknot's spreading through software vulnerabilities, including ElasticSearch's Java Virtual Machine. Update your software with the provided security hot-fixes for removing these hazards.

A majority of credible anti-malware solutions should detect and delete Elknot, Linux/DDoSMan, and similar threats by default, but any vulnerabilities regarding previously-leaked credentials may require the users taking additional steps for securing their account logins.

Elknot is an old idea experiencing creative uses with the help of at least one group of hackers in China. What else enterprising Black Hats can come up with through its executable generator remains for the rest of the world's seeing, one way or the other.