A newly discovered trojan is infecting Linux systems and possibly building up an arsenal of devices to be used in distributed denial-of-service (DDoS) attacks, according to a blog post from Avast.

The new threat, XOR.DDoS, alters its installation depending on the victim's Linux environment and then later runs a rootkit to avoid detection. Although a similar trojan has been spotted in Windows systems, Peter Kálnai, malware analyst at Avast, said in a Wednesday interview that this trojan ventures into relatively untapped territory by targeting Linux systems.

“It's very hard to set a rootkit component within a Linux boundary because it needs to agree with the versions of the victims' operating systems,” Kálnai said.

Attackers using XOR.DDoS prey on users who haven't changed default logins for their devices through brute force tactics against various network IDs. If successful, the trojan will then determine whether it's compatible with the kernel headers installed on the victims' systems and install a rootkit, if so.

“The rootkit hides all the files that are indicators of compromise, so the victims could not see those indicators,” Kálnai explained. “It also hides processes and other indicators of compromise.”

Kálnai said that the rootkit aspect of the attack was first spotted around October 2014. The trojan itself was initially detailed on MalwareMustDie in September 2014.

The trojan and its variants can infect 32-bit and 64-bit Linux web servers and desktops, as well as ARM architecture, which could indicate that routers, Internet of Things (IoT) devices, NAS storages and 32-bit ARM servers could be also be affected, the blog post said.

Not many infections have been detected yet, although those that have been do not follow a particular pattern. Both enterprises and individuals could be impacted, although Kálnai noted that individuals should be particularly aware of the threat, as enterprises typically have stronger security measures in place.

The Avast analyst also noted a small group is likely behind most infections because the trojan hasn't been spotted on any forums.

Now that xpy is worthless and cant be spent anywhere,the Gawtards have come up with a new idea.We cant spend it so lets give it away in freebies and prizes to each other

For people who dont have the knowledge or infrastructure in place to run a ddos attack heres a handy link from days gone bye but still a worthy client.
PLEASE YOU THIS FOR EDUCATIONAL PURPOSES ONLY

https://github.com/NewEraCracker/LOIC/

Attackers must realise you cant go after CloudFlare directly, you have to start targeting there upstream peers and exchanges.
Once you realize you cant knock CloudFlare itself offline even with more than 100Gbps of DDoS traffic, you have to go after there direct peers. in any case, you must attack the providers from whom CloudFlare buys bandwidth. They, primarily, contract with what are known as Tier 2 providers for CloudFlare's paid bandwidth. These companies peer with other providers and also buy bandwidth from so-called Tier 1 provider that is what you must hit with between Gbs30 and Gps70 though I have the ability to attack with between 90-100 Bps after bringing down cloudflare the company is wide open to hack

cryptodouble is owned by the same russian that owns www.c-cex.com

Nobody has ddos attacked Cryptodouble is has really heavy cloudflare protection anybody that says they have are liars or real pro hackers like me

I think @rootdude is just blowing his trumpet about Ddos a site with any magnitude.I was an IT security analyst it takes me busy to take a large site down and keep it down unless Gaw has control of its customers computers

Daffy
Daffy
 Admin
 Paycoin Origin
@buckrogers yeah it's discusting they really are hurting everything that has to do with crypto.

Simple things make people happy.
FAQs, Costs/Fees, Payouts
XPY Tips PDaffyVfp5pUyHrP9o9BUdEkUFfxyWfaxJ
BTC Tips 1DaffykYjohRjqVYMcGjgHgqBokBUekSH6

@daffy whats really hurting crypto is the lies josh told me to get me to get involved,will set a floor at $20,will buy your xpy at $20 up to $700 a week.You can buy at amazon walmart etc.You might shout Josh is the second coming on hashtalk but you are hiding the fact your selling off your account like other admin/mods on there but lie about it.Like josh your are just an out and out liar but the fact your admin you know about the scam and will go to jail with him.Better tell the wife you can lose your house over this when you are all sued

"they dont have lawyers or a few thousand dollars".Josh owns the biggest internet provider in New England and Gaw miners were the biggest bitcoin miner seller in the world yes I believe its a scam but dont make stupid comments like that just makes the dissenters look like idiots

just checked i am still banned,looks like @daffy is selling off his account bit by bit via Pms my friend just bought loads of stakers and primes of him,rats deserting a sinking ship

Gaw miners and all subsidiaries are registered in CT

I have now sent an email to the state attorney general asking him to look at the entire paycoin/paybase/gaw investments and promises 

This thread is really drifting away from the point,does it matter what cars he has the main point is he going to live up to the statements that got me to invest in his company in the first place

A lot of people are interested who founded bitcoin and who they are,just because your not does not mean others are not.If you dont want to be part of the research leave the thread.

Hearing from a crypto magazine journalist who wants to remain anon the SEC is involved in this debacle with Gaw miners

according to my research there were 3 people mining at the start,and if you check apart from testing wallets by sending btc to each other none of the first 3 wallets have sold any bitcoin.There wallets have been inactive for years

Think if you sit down and do some deep research instead of just voicing off on this thread you will find a connection between Hashie and Gaw miners.Not saying connection is straight to Josh but deff to his trusted admin staff but then again Josh could be involved but need to do some more research on that.

Hal Finney

My password wont work now can you send me a new one please I sent you a message on the site yesterday

Please note certain members of Gaw admin are involved in this site