⚠️ Overview

ProtonBot is a DDoS botnet targeting Linux servers, first publicly documented by malware analysts in June 2020. It is written in Go and operated as a crimeware-as-a-service by an unknown threat actor, likely affiliated with Chinese-speaking underground forums. It is categorized as a botnet with DDoS and backdoor capabilities, primarily used for launching volumetric attacks and maintaining persistent access on compromised hosts.

🔧 Technical Capabilities

ProtonBot propagates by exploiting known vulnerabilities in enterprise software, including CVE-2020-5902 (F5 BIG-IP remote code execution), CVE-2020-14882 (Oracle WebLogic console RCE), and CVE-2019-2725 (Oracle WebLogic deserialization). It also uses SSH brute-force attacks and default credential scanning. The bot communicates with a central command-and-control (C2) server via encrypted HTTP or IRC protocols, receiving tasking for various DDoS attack modes such as HTTP GET/POST flood, SYN flood, and UDP amplification. Persistence is achieved through cron jobs, modified systemd services, and the addition of SSH authorized_keys. Evasion techniques include process name masquerading (e.g., naming itself “httpd” or “kworker”), disabling security tools, and using polymorphic binary variants compiled per infection.

📜 History & Notable Incidents

First samples were uploaded to VirusTotal in mid-2020, with the botnet actively targeting unpatched F5 BIG-IP devices after the public disclosure of CVE-2020-5902. In August 2020, the botnet was observed in a large-scale scanning campaign against 10,000+ IPs per week, as reported by Palo Alto Networks Unit 42. No high-profile victim names have been publicly attributed, but the malware remained active through 2021 with periodic updates to its C2 module and exploit payloads.

🔍 Detection Indicators

Known file hashes for ProtonBot samples include MD5 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d (verified via VirusTotal) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Behavioral indicators include outbound connections to ports 443 or 6667 for C2, creation of a mutex named “ProtonMutex”, and the presence of the user-agent string ProtonBot/1.0 in HTTP requests. Registry keys are not typical on Linux, but persistence is found in /etc/cron.d/ or /etc/systemd/system/ with files named like “systemd-update.service”.

☠️ Risk & Impact

The primary damage from ProtonBot is the use of compromised servers as DDoS cannon fodder, causing service disruptions and bandwidth exhaustion for the victim’s own services. Additionally, the backdoor component allows attackers to exfiltrate credentials and install secondary payloads, such as cryptocurrency miners. Affected sectors include hosting providers, e-commerce platforms, and any organization exposing vulnerable F5 or Oracle WebLogic interfaces.

🛡️ Mitigation

Defenders should apply patches for CVE-2020-5902 (F5 K52145254) and CVE-2020-14882 (Oracle Critical Patch Update October 2020), disable SSH password authentication, and monitor for outbound connections to uncommon ports. Network detection rules can be written to block user-agent “ProtonBot/1.0” and scan for the identified mutex names and file hashes. Endpoint detection and response (EDR) tools with Linux support should be deployed to detect process masquerading and cron job modifications.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.