DemonBot Targeting Hadoop Clusters to Perform DDoS Attacks

A new bot called DemonBot is targeting Hadoop clusters to execute distributed denial-of-service (DDoS) attacks.

The Radware Threat Research Center recently observed a threat actor exploiting a Hadoop Yet Another Resource Negotiator (YARN) unauthenticated remote command execution. This method of attack enables the malicious agent to infect clusters of Hadoop, an open source distributed processing framework that helps big data apps run in clustered systems, with DemonBot. Upon successful infection, the threat connects to its command-and-control (C&C) server and transmits information about the infected device.

Why Cloud Infrastructure Servers Are Juicy Targets

The threat’s goal is to leverage infected cloud infrastructure servers to conduct DDoS attacks. At this juncture, it is not exhibiting worm-like behavior akin to Mirai. Instead, it relies on 70 exploit servers for distribution, infrastructure that helps it perform 1 million exploits every day.

That being said, Radware found DemonBot to be binary-compatible with most Internet of Things (IoT) devices, which means the threat could spread to other types of products.

DemonBot isn’t the first bot to target cloud infrastructure servers like Hadoop clusters. In early October, a security researcher reported on Twitter that handlers of the Sora IoT botnet attempted to exploit the same YARN abused by DemonBot.

Radware attributed the growing interest in Hadoop to the fact that cloud infrastructure servers allow bad actors to stage larger and more stable DDoS attacks using multiple vectors, such as User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) floods.

How to Defend Against DemonBot

Security professionals can help protect their organizations against DemonBot by conducting a proper risk assessment on their cloud deployment. From there, they should enlist the help of penetration testers to map the vulnerabilities affecting their deployment.

Security teams should also look to invest in mitigation tools and services that specialize in defending against a DDoS attack.

Sources: Radware, Ankit Anubhav

David Bisson

Contributing Editor

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Why Cloud Infrastructure Servers Are Juicy Targets

How to Defend Against DemonBot

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates