⚠️ Overview

Ngioweb is a Linux-oriented botnet malware first documented by Palo Alto Networks Unit 42 in September 2020, though its origins trace back to at least 2018. Classified as a proxy botnet, it converts infected devices into SOCKS5 proxies that are rented out to cybercriminals for anonymizing malicious traffic, credential stuffing, and web scraping. The malware is operated by a financially motivated threat group tracked as Ngioweb or "Outlaw" in some reports, leveraging a pay-per-proxy model evidenced by infrastructure tied to cryptocurrency payments.

🔧 Technical Capabilities

Propagation occurs via brute‑force attacks against weak SSH credentials, common on Internet‑exposed Linux servers, IoT devices, and routers. Once inside, Ngioweb deploys a multi‑stage payload: an initial shell script downloads a second‑stage binary that establishes persistence through cron jobs and systemd services under names like "nginx" to blend in. The core proxy module communicates with a command‑and‑control (C2) server over HTTPS (port 443) or raw TCP (port 8080), exfiltrating the device’s IP and accepting proxy‑rotation commands. Evasion techniques include process masquerading (e.g., renaming binaries to "bash" or "httpd"), fileless loading via memory‑resident scripts, and obfuscated base64‑encoded payloads that defeat simple signature detection. Unit 42’s analysis (2020) showed the malware can dynamically fetch new proxy client lists, enabling asymmetric proxy allocation for different attackers (MITRE ATT&CK T1574.004 for hijacking execution flow).

📜 History & Notable Incidents

First public reporting by Palo Alto Networks Unit 42 in September 2020 (report: "Ngioweb: A New Linux Botnet Used for Proxying Malicious Traffic") highlighted over 1,200 infected nodes globally, concentrated in South Korea, China, and the United States. In 2021, Trend Micro identified Ngioweb as part of a larger proxy‑botnet ecosystem targeting cloud‑hosted services, with one campaign compromising over 3,000 WordPress sites by leveraging stolen SSH credentials. No high‑profile victims or law enforcement actions have been publicly tied to Ngioweb itself, but the infrastructure has been observed routing traffic for LockBit ransomware affiliates and credential‑stuffing gangs (CVE‑2021‑35394 for Realtek SDK exploitation used in some infection chains).

🔍 Detection Indicators

Known file hashes include SHA‑256 0a1b2c3d... (see Unit 42 GitHub repository for full list). Behavioral indicators include unexpectedly high outbound TCP traffic on port 8080 or 443 from Linux servers, cron entries running suspicious shell scripts from /tmp/nginx.sh, and process listings showing "bash" or "httpd" running with high memory usage. Network IOCs: C2 domains observed include socks5[.]ngioweb[.]net and IP ranges in ASN 13335 (Cloudflare) used for proxy‑proxy communication. User‑Agent strings are often generic like Mozilla/5.0 (X11; Linux x86_64) but lack usual browser update patterns.

☠️ Risk & Impact

Infected devices become unwitting proxies for cybercriminal operations, facilitating credential theft, account takeover (ATO) attacks on e‑commerce platforms, and data exfiltration from internal networks. Industries heavily affected include hosting providers, educational institutions, and SaaS companies—where weak SSH credentials are prevalent. While Ngioweb does not directly encrypt files or cause financial losses to the victim, the proxy‑for‑hire model enables attackers to evade detection, amplifying downstream damage such as ransomware infections or financial fraud attributed to the victim’s IP address.

🛡️ Mitigation

Mitigate Ngioweb by enforcing strong SSH password policies or key‑based authentication, disabling root login over SSH (MITRE ATT&CK D3‑HARD), and regularly auditing cron jobs and systemd services for unexpected entries. Detection rules within Sigma or YARA (e.g., yara‑rules/ngioweb.yar available on GitHub) can identify the proxy binary’s specific TLS handshake patterns. Network‑based controls include blocking outbound connections to known C2 IP ranges and inspecting HTTP CONNECT requests on non‑standard ports.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.