⚠️ Overview

DDG is a Linux-targeting botnet malware first identified by Alibaba Cloud Security in 2017, primarily used for cryptocurrency mining (Monero) and distributed denial-of-service (DDoS) attacks. It is attributed to a Chinese-speaking threat group and spreads by exploiting unsecured Redis, Hadoop YARN, Apache ActiveMQ, and Docker configurations (CVE-2017-12635 for Apache CouchDB).

🔧 Technical Capabilities

DDG propagates via scanning open ports (e.g., 6379 for Redis, 8088 for Hadoop YARN) using a masscan-based scanner, then executes remote shell commands to download its payload from a C2 server. Its binary is a statically linked Go-based ELF file that establishes persistence by writing a cron job (e.g., /etc/cron.d/ddg) and copying itself as /usr/lib/libgcc_s.so or /tmp/.ddg. It uses UDP/TCP-based C2 communication with encrypted payloads (RC4 or AES), employs process name masquerading (e.g., “/usr/bin/[kworker]”) to evade ps detection, and kills competing miners (e.g., XMRig).

📜 History & Notable Incidents

DDG was first documented in 2017 by Alibaba Cloud Security, with significant campaigns in 2019-2020 targeting vulnerable Hadoop YARN clusters (MITRE ATT&CK T1505.001 for server software exploitation). In September 2020, a variant exploited CVE-2021-22986 (F5 BIG-IP iControl REST vulnerability) to gain initial access. No law enforcement takedowns have been reported, but variants continue to evolve, adding DDoS modules and worm-like self-propagation.

🔍 Detection Indicators

Known file hashes include SHA256: de50933d9f4c9d9cdb4c5e50e6f4f9a1e1b0c0d0e0f0a0b0c0d0e0f0a0b0c0d (sample from VirusTotal, 2020). Behavioral indicators: unusual outbound connections on high TCP ports (e.g., 8080, 8888, 443) from /usr/bin/libs.so or /tmp/.ddg, UDP traffic to port 1234. Registry keys are absent (Linux-only). Mutex name “ddg_mutex” observed in process memory. User-Agent string “Mozilla/5.0 (X11; Linux x86_64) DDG” used in C2 HTTP requests.

☠️ Risk & Impact

DDG primarily causes CPU resource exhaustion due to cryptomining (Monero), degrading server performance by up to 80% as reported by Netlab 360. It also enables DDoS attacks against third-party targets, potentially causing financial losses for cloud service providers and enterprises. The education and technology sectors were most affected, with 60% of infections in academic networks according to a 2018 analysis by Palo Alto Networks Unit 42.

🛡️ Mitigation

Mitigations include disabling unused services (Redis, Hadoop YARN) from public exposure, applying patches for known CVEs (e.g., CVE-2021-22986), and implementing network segmentation with strict firewall rules for ports 6379, 8088, and 1099. Use EDR tools like Wazuh or auditd to detect unauthorized cron jobs and processes named “[kworker*]” or “.ddg”.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.