A new version of the BASHLITE malware is designed to scan compromised networks for devices that use BusyBox and attempts to gain control of them by leveraging the recently disclosed GNU Bash vulnerability referred to as ShellShock.
The first variant of BASHLITE, detected as ELF_BASHLITE.A (ELF_FLOODER.W), was spotted by Trend Micro shortly after the existence of the ShellShock bug came to light. The threat, which was the payload of the ShellShock exploit code, had been used to launch distributed denial-of-service (DDoS) attacks.
ELF_BASHLITE.A checked to see if infected devices were running BusyBox, a set of programs needed to run a Linux system. BusyBox is designed for embedded operating systems such as the ones running on routers.
A newer version of BASHLITE spotted by Trend Micro researchers (ELF_BASHLITE.SMB) is designed not only to identify systems running BusyBox, but to also hijack them.
The malware first scans the network for BusyBox devices and attempts to access them by using a predefined list of usernames and passwords. The list of passwords includes “root,” “admin,” “12345,” “pass,” “password” and “123456.”
“Once a connection is established, it runs the command to download and run bin.sh and bin2.sh scripts, gaining control over the Busybox system,” Rhena Inocencio, threat response engineer at Trend Micro, wrote in a blog post on Thursday. “Remote attackers can possibly maximize their control on affected devices by deploying other components or malicious software into the system depending on their motive.”
Trend Micro advises administrators to make sure they change the default credentials on their network devices and disable remote shell if possible.
The ShellShock vulnerability was disclosed on September 24 and by September 30 security firms estimated that attacks using the exploit could top 1 billion. In mid-October, researchers reported that the Linux botnet known as Mayhem was also leveraging ShellShock to expand.
In the month following the disclosure of the flaw, several high-profile companies started releasing software updates to patch their products. However, as expected, many systems remain unpatched, allowing cybercriminals to abuse them.
Earlier this week, the cross-browser testing service BrowserStack revealed that cybercriminals breached an unpatched server using ShellShock and ultimately gained access to customer information. The hackers obtained email addresses which they used to tell customers that the service was shutting down.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
Latest News
- Germany Appoints Central Bank IT Chief to Head Cybersecurity
- OpenSSL Ships Patch for High-Severity Flaws
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Vulnerability Provided Access to Toyota Supplier Management Network
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- Linux Variant of Cl0p Ransomware Emerges
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
