SSH wormable, written in Bash, updates itself and hard to detect. The DarkRadiation ☢️ Ransomware

This new ransomware is cut from a different cloth. Let us discuss

* SSH Wormable
* Encrypts with AES (OpenSSL)
* It mutates so anti-viruses can’t catch it
* Bash
* Still under development

Support my work on PayPal

Become a Member on YouTube

🧑‍🏫 Courses I Teach

🏭 Backend Engineering Videos in Order

💾 Database Engineering Videos

🎙️Listen to the Backend Engineering Podcast

Gears and tools used on the Channel (affiliates)

🖼️ Slides and Thumbnail Design
Canva

🎙️ Mic Gear
Shure SM7B Cardioid Dynamic Microphone

Cloudlifter

XLR cables

Focusrite Audio Interface

📷 Camera Gear
Canon M50 Mark II

Micro HDMI to HDMI

Video capture card

AC Wall for constant power

Stay Awesome,
Hussein

[kevinshah_tv]

That small giggle at the end after discovering something weird / cool is the feeling we have had at least once.

[LVLV]

I subscribed to you because of this video!
Great job. Look forward to watching all your other videos.

[JernMr]

Lateral network movement can be quite easily detected by using a network anomaly detection solution. Also, a firewall with IPS and Antibot can be quite useful for detecting CnC, but would require some engineering to properly implement it :). Great video. Great attack :)

[autohmae]

They way I see it, this is wormable, but not yet a worm. It doesn't spread by itself, it's spread through commands from C&C. This one is definitely not the first (although these things are less common on Linux, but more common on Windows), the Bash obfuscation is pretty new though. Most just try to hide their processes and files (this one tries to do the same).
7:02 maybe Red Buts ? (possibly red butts ?)
9:54 the developer computer has the private key, so the developer computer needs to be infected. But usually incoming SSH is turned off on laptops and the laptop is behind NAT and not directly Internet connected.
12:12 pretty certain the attacker obfuscates it before uploading to a victim. They were just able to recognize the method that was used.
15:28 emojies are just Unicode characters and Unicode characters are allowed in filenames.

[yourpersonaldatadealer]

I find it absolutely fascinating. I wonder what it will be like when they start using more advanced AI (imagine asking GPT v10 to build you a never seen before virus)

[AbhinavKulshreshtha]

As a linux user, I really want to take a look at bash source code.

[professortrog]

That is why you have to use a password on your keypair.

[NaveenTulsi]

Dear fellow viewer, are there more channels which talk about similar backend and SW analysis?

[nikhilsinghal]

Well, we were also hit by a worm. They were mining bitcoin on our machine. Our dev machine got extremely slow and then we saw most of our CPU was being eaten by bitcoin mining process. Later we figured out that it came from postgres port which we were using to connect dev db to our local machine.

[gmanon]

Ransomware updating themselves. This seems to be the most dangerous feature.

It should be an update registration and every service running should have it's own user to stop random applications to have root access.

Also, the pgp or hashing habilities should be exclusive to very few absolutely necessary applications. Not everything needs to be encrypted.
.

[supriyochatterjee]

Please kindly upload videos on AWS AND AZURE ISSUES AND TROUBLESHOOTING

[UzairAli]

13:15 This is why human will corrupt advance AI in future resulting in total chaos

[siya.abc]

Node brought us the best and worst of the Web

[MartinsTalbergs]

shouldn't be too hard to create such script