Linux botnet observed launching powerful DDoS attacks
Threat actors are leveraging a botnet made up of infected Linux machines to launch powerful distributed denial-of-service (DDoS) attacks against as many as 20 targets per day, according to Akamai's Security Intelligence Response Team (SIRT). The botnet is composed of Linux machines infected with a stealthy trojan identified in 2014 as "XOR DDoS." The threat was observed altering its installation depending on the victim's Linux environment and running a rootkit to avoid detection. According to an advisory published on Tuesday, Akamai's SIRT has seen DDoS attacks – SYN and DNS floods were the observed attack vectors – that reached anywhere from a few gigabits per second (Gbps) to nearly 179 Gbps. Although the advisory said that 90 percent of targets are located in Asia, Tsvetelin Choranov, security intelligence response engineer with Akamai's SIRT, told SCMagazine.com in a Tuesday email correspondence that a very small number of attacks have been lau...
