From thehackernews.com
The threat actors behind ShellBot are leveraging IP addresses transformed into its hexadecimal notation to infiltrate poorly managed Linux SSH servers and deploy the DDoS malware.
“The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value,” the AhnLab Security Emergency response Center (ASEC) said in a new report published today.
ShellBot, also known by the name PerlBot, is known to breach servers that have weak SSH credentials by means of a dictionary attack, with the malware used as a conduit to stage DDoS attacks and deliver cryptocurrency miners.