Kaspersky’s Global Emergency Response Team (GERT) and Global Research and Analysis Team (GReAT) uncovered NKAbuse, a novel multiplatform malware. This advanced threat, developed in Go, uses peer-to-peer communication, functioning both as a flooder and a backdoor.
In a recent incident response, Kaspersky’s experts found a new malware that exploits NKN technology, a peer-to-peer, blockchain-oriented networking protocol, known for its decentralization and privacy. Kaspersky Security Network identified potential victims of the attack in Colombia, Mexico, and Vietnam.
NKAbuse is a hybrid implant that serves as both a backdoor/RAT and a flooder, making it a versatile dual- threat. In its backdoor/RAT role, NKAbuse provides attackers with unauthorized access to victims’ systems, enabling the attacker to covertly execute commands, steal data, and monitor activities. This feature is particularly valuable for espionage and data exfiltration. Simultaneously, as a flooder, it is capable of launching destructive DDoS attacks, overwhelming and disrupting targeted servers or networks, significantly impacting organizational operations.
The malware’s advanced features extend to capturing screenshots, managing files, retrieving system and network information, and executing system commands. All collected data is sent to its botmaster via the NKN network, using decentralized communications for stealth and efficiency.
NKAbuse’s infiltration process begins by exploiting the old RCE vulnerability CVE-2017-5638,
“The implant’s use of the NKN protocol underlines its advanced communication strategy, enabling decentralized, anonymous operations and leveraging NKN’s blockchain features for efficient, stealthy communication between infected nodes and C2 servers. This approach complicates detection and mitigation efforts. I would like to commend the Kaspersky GERT team for their exceptional effort in identifying this sophisticated threat,” says Lisandro Ubiedo, Security Researcher at Kaspersky’s GReAT.
The choice of Go enables cross-platform compatibility, allowing NKAbuse to target various operating systems and architectures, including Linux desktops and IoT devices. This programming language enhances the implant’s performance, particularly in networked applications, ensuring efficient and concurrent processing. Moreover, Go’s ability to produce self-contained binaries simplifies deployment and enhances robustness, making NKAbuse a formidable tool in the realm of cybersecurity threats.
All Kaspersky products detect NKAbuse as HEUR:Backdoor.Linux.
To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:
Update your operating system, applications, and antivirus software regularly to patch any known vulnerabilities.
Provide your SOC team with access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal is a single point of access for the company’s TI, providing cyberattack data and insights gathered by Kaspersky spanning over 20 years.
Upskill your cybersecurity team to tackle the latest targeted threats with Kaspersky online training developed by GReAT experts.
For endpoint level detection, investigation, and timely remediation of incidents, implement EDR solutions such as Kaspersky Endpoint Detection and Response.
Investigate alerts and threats identified by security controls with Kaspersky’s Incident Response and Digital Forensics services to gain deeper insights.