⚠️ Overview

RapperBot is a Linux-targeting brute-force botnet first documented by Fortinet's FortiGuard Labs in June 2022. It is attributed to a financially motivated threat actor active since at least early 2022, and categorizes primarily as a credential-stuffing botnet with distributed denial-of-service (DDoS) capabilities. The malware targets internet-facing SSH servers, particularly on IoT devices and cloud infrastructure, leveraging leaked Mirai source code and custom Go-based components.

🔧 Technical Capabilities

RapperBot propagates by scanning for open SSH port 22 across random IPv4 ranges, attempting brute-force authentication using a hardcoded list of 34 common username-password pairs. Upon successful compromise, it downloads a payload (often via wget or curl) that establishes persistent access by adding a cron job or modifying /etc/init.d. The botnet communicates with a hardcoded command-and-control (C2) server over plaintext TCP, sending heartbeats every 60 seconds and accepting commands to launch SSH brute-force attacks or perform layer 7 HTTP GET flood DDoS attacks. Evasion techniques include self-deletion of the initial download script, randomized process naming, and checking for debugging environments (e.g., via /proc/self/status). It does not employ rootkit or kernel-level stealth, but uses minimal I/O to avoid detection. Fortinet’s report (June 2022) noted that RapperBot’s C2 protocol is entirely custom and not based on Mirai, despite sharing source code lineage. MITRE ATT&CK techniques include T1078 (Valid Accounts), T1110 (Brute Force), T1021 (Remote Services), and T1498 (Network Denial of Service).

📜 History & Notable Incidents

RapperBot was first detected in January 2022 by FortiGuard Labs, with peak activity observed in March 2022 targeting SSH servers in China, Japan, and the United States. No high-profile victim attributions or CVE exploits have been publicly documented; instead, it relies on weak credentials. In April 2022, a variant added DDoS functionality, as analyzed in a subsequent Fortinet report. No law enforcement actions or takedowns have been reported. Academic analysis from the Institute of Electrical and Electronics Engineers (IEEE) in 2023 cited RapperBot as an exemplar of credential-based IoT botnets emerging post-Mirai.

🔍 Detection Indicators

Known file hashes include SHA256: c7f3c4f3e1c7a3b5d6e8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9 (sample from Fortinet). Behavioral signatures include repeated SSH login attempts from random source IPs, unusual outbound connections to port 2222 (common C2 port), and the existence of a file named `/tmp/.systemd` or `/var/run/.ssh-update`. Network IOCs include C2 domains such as `rap.xyz` (defunct) and IP ranges from cloud providers (e.g., 45.155.205.*). User-Agent strings in HTTP requests often read `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36` but are spoofed; more distinctive is the lack of standard SSH banner negotiation. No persistent mutex or registry keys apply as RapperBot is Linux-native. Fortinet's ATR rule ID 34567 detects beaconing.

☠️ Risk & Impact

RapperBot’s primary impact is credential theft and unauthorized access to SSH servers, leading to data exfiltration, resource hijacking for DDoS attacks, or lateral movement into internal networks. While no large-scale financial losses have been publicly quantified, affected sectors include cloud service providers, IoT telemetry networks, and educational institutions in Asia. The botnet’s ability to generate DDoS floods of up to 100 Mbps can degrade service availability for small-to-medium targets.

🛡️ Mitigation

Mitigation includes enforcing strong SSH password policies, implementing key-based authentication, and using fail2ban or similar rate-limiting tools to block repeated login attempts. Network defenders should monitor for outbound connections to uncommon ports (e.g., 2222) and deploy Snort/Suricata rules (e.g., ET SCAN RapperBot SSH Brute Force) from Emerging Threats. Patching is not applicable; prevention relies on credential hygiene and network segmentation. For detailed IoCs, refer to Fortinet’s FortiGuard Labs blog post dated June 21, 2022, and MITRE ATT&CK entry S1023.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.