Mayhem Botnet

Posted: February 12, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	9

First Seen:	February 12, 2015
Last Seen:	October 18, 2020
OS(es) Affected:	Windows

The Mayhem Botnet is a multi-component Trojan hosted on compromised Linux and Unix-based Web servers. Its flexible use of encrypted, hidden plugins allows third parties to use compromised servers to spread the infection to further websites, with its current infection numbers estimated at well over one thousand. The Mayhem Botnet also can execute additional commands sent by its Command & Control server, such as downloading new files, changing its plugins or transferring data. Website administrators are advised to use automated security tools to delete all components of a Mayhem Botnet, and take all additional steps to prevent any compromised data from being abused in the future.

The Lingering Mayhem of a Bash Vulnerability

The Mayhem Botnet saw analysis and press attention as long ago as July of the past year. Despite that, like many botnets, the Mayhem Botnet continues to see updates and procedural modifications that make the Mayhem Botnet a new and relevant threat for 2015. Rather than being designed for personal computers, the Mayhem Botnet attacks *nix-based website servers, and even is capable of distributing itself and other threats to new servers. Although the Mayhem Botnet includes many of the functions that one would expect of a botnet, the Mayhem Botnet also can run under accounts with restricted privileges (rather than requiring root-level access from an account).

The Web servers compromised by a Mayhem Botnet may be hijacked via brute forcing their account passwords, by phishing them from administrators or by other, third-party methods (such as a zero-day software vulnerability). Hidden and encrypted files are the Mayhem Botnet's optional plugins, providing variable functions while its main component is an ELF library file.

Some of the Mayhem Botnet's latest attacks have been noted to reuse the same IP addresses also associated with notable Shellshock attacks. In turn, malware researchers note that this common ground could be indicative of the Mayhem Botnet also including functions to abuse Shellshock. Shellshock, a vulnerability noted for its astounding lifespan prior to being patched, as well as its nigh-universal compatibility and simplicity of abusing, allows third parties to launch threatening code in Bash. However, Windows machines are unaffected. Some of the illicit activities known associated with Shellshock include spyware attacks (using threats to collect information, such as account passwords) and DDoS campaigns (crashing websites via fake traffic).

Calming the Tremors of a Shellshocked Botnet

The Mayhem Botnet is a foremost security issue for website administrators maintaining their sites via Unix and Linux-based servers. Although most, relevant programs have been patched to block the Shellshock vulnerabilities, other capabilities of a Mayhem Botnet campaign still are open for exploitation by third parties. Awareness of all common infection vectors and having durable website security should be sufficient for blocking the attacks that could install the Mayhem Botnet onto your server. When preventative defenses are insufficient, proper anti-malware products or a PC security professional should be consulted for removing the Mayhem Botnet, which uses files and other components not immediately visible.

For such site administrators, time also is a notable factor in dealing with the Mayhem Botnet. Since the Mayhem Botnet includes commands for uploading, downloading and otherwise giving remote attackers unhindered access to a Web server, the less time you take before action, the less chance there is of any damage being incurred.

Mayhem Botnet

Threat Metric

The Lingering Mayhem of a Bash Vulnerability

Calming the Tremors of a Shellshocked Botnet

Leave a Reply