By 
The FritzFrog botnet has reappeared after more than a year with a new P2P campaign to compromise servers belonging to entities in the healthcare, education, and government sectors infecting a total of 1,500 hosts within a month.
FritzFrog, a peer-to-peer botnet written in the Golang programming language was discovered in January 2020. For almost eight months, the botnet managed to strike at least 500 government and enterprise SSH servers.
The P2P botnet is decentralized in nature and will attempt to brute-force servers, cloud instances, and other devices -- including routers -- that have exposed entry points on the internet.
The cybersecurity researchers from Akamai Threat Labs stated that the botnet has reappeared with an exponential growth surge after being quiet since December.
The researchers stated that FritzFrog propagates over SSH. Once it finds a server's credentials using a simple brute force technique, it establishes an SSH session with the new victim and drops the malware executable on the host. The malware then starts listening and waiting for commands.
In total, 24,000 attacks have been detected and 1,500 hosts have been infected, the majority of which are located in China. The botnet is used for cryptomining.
Their target list includes healthcare, education, and government sectors. Due to its new functionality and the usage of a proxy network, the malware is also being prepared to hone in on websites running the WordPress content management system (CMS).
A TV channel in Europe, a Russian healthcare equipment manufacturer, and universities in Asia have been compromised.
FritzFrog is considered as a "next-generation" botnet due its key features which includes consistent update and upgrade cycles, an extensive dictionary used in brute-force attacks, and its decentralized architecture, which is described as "proprietary”.
The origin of the botnet is not known, but there are some indicators that the operators are either based in China or are impersonating operators in the country. A newly-added file transfer library links to a GitHub repository owned by a user in Shanghai.
Besides, the botnet's cryptocurrency mining activity links to wallet addresses also used by the Mozi botnet, in which operators were arrested in China.
Image Credits : Guardicore
