Diicot expands its tactics with the Cayosin Botnet, moving from cryptojacking to DDoS assaults.

 Recently discovered payloads have been linked to the Romanian threat actor Diicot, according to cybersecurity specialists. The results revealed the group's growing capacity, particularly its potential to launch distributed denial-of-service (DDoS) attacks.

The researchers point out the relevance of the name Diicot, which also corresponds to the Romanian organised crime and anti-terrorism enforcement unit. It was revealed in a technical report by Cado Security. The investigation also finds that materials from Diicot's efforts use language and imagery that allude to this group, suggesting a possible connection.

Diicot, formerly known as Mexals, was first discovered by Bitdefender in July 2021 using a Go-based SSH brute-forcer tool named Diicot Brute to infiltrate Linux systems as part of a cryptojacking effort. Akamai revealed a resurgence of the group's activity in April of this year, which they suspect began around October 2022 and resulted in about $10,000 in illegal revenues.

A Secure Shell Protocol (SSH) worm module, increased payload obfuscation, a new LAN spreader module, and improved reporting capabilities were some of the new strategies Diicot launched during this revival. Stiv Kupchik, an Akamai researcher, emphasised that the attackers use a lengthy chain of payloads, which ends with the deployment of a Monero cryptominer.

A commercial botnet called Cayosin is now being used by Diicot, according to the most recent study by Cado Security. This malware family resembles popular botnets like Qbot and Mirai, indicating the threat actor's expanding capacity to plan DDoS operations. Diicot has engaged in DDoS assaults as well as other actions like doxxing competing hacker organisations, showing that they take a diversified approach to their business. The organisation also uses the chat service Discord for data exfiltration and command-and-control functions.

According to the cybersecurity firm, Diicot especially targets routers running OpenWrt, a Linux-based embedded devices operating system, when it deploys Cayosin. This usage of Cayosin indicates the threat actor's willingness to conduct a variety of attacks, beyond just cryptojacking, depending on their target's profile.

Diicot's compromise chains have always followed the same pattern, with the unique SSH brute-forcing tool serving as a launchpad for other malware, such as Mirai variants and crypto miners. In addition to these instruments, Diicot also used a number of others, including Chrome, an internet scanner that logs its findings in a text file, and Update, an executable that, in the event that Chrome and the SSH brute-forcer are not already present on the machine, retrieves and runs them. The Update tool is intended to be launched by the shell script known as the History tool.

The text file created by Chrome is scanned by the SSH brute-forcer programme, also known as aliases, in an attempt to acquire unauthorised access to each IP address. In the event that it succeeds, it creates a remote connection and launches a series of tasks to profile the compromised server. Depending on the capabilities of the CPU (that is, if the hacked machine's CPU has fewer than four cores), the compromised machine is then either used to deploy a cryptominer or serve as a spreader.

Organisations are highly encouraged to install SSH hardening measures and firewall rules to limit SSH access to only certain IP addresses in order to prevent such attacks. The campaign specifically targets SSH servers that are accessible via the internet, especially those that have enabled password authentication, according to Cado Security. The researchers also highlighted that Diicot uses a small list of default and understandably guessable username/password combinations.

Organisations must maintain vigilance and proactively deploy effective cybersecurity measures as Diicot develops its attack capabilities and arsenal. Companies can better protect themselves against the constantly changing world of cybercrime by remaining educated about new threats and adhering to advised security practises.