DDoS IRC Bot Malware Spreading Through Korean WebHard Platforms

An IRC^[1]
(Internet Relay Chat) bot strain programmed in GoLang is being used
to launch distributed denial-of-service (DDoS) attacks targeting
users in Korea.

“The malware is being distributed under the guise of adult
games,” researchers from AhnLab’s Security Emergency-response
Center (ASEC) said^[2]
in a new report published on Wednesday. “Additionally, the DDoS
malware was installed via downloader and UDP RAT^[3] was used.”

The attack works by uploading the malware-laced games to
webhards, which refers to a web hard drive or a remote file hosting
service, in the form of compressed ZIP archives that, when opened,
includes an executable (“Game_Open.exe”) that’s orchestrated to run
a malware payload aside from launching the actual game.

This payload, a GoLang-based downloader, establishes connections
with a remote command-and-control (C&C) server to retrieve
additional malware, including an IRC bot that can perform DDoS
attacks.

“It is also a type of DDoS Bot malware, but it uses IRC
protocols to communicate with the C&C server,” the researchers
detailed. “Unlike UDP Rat that only supported UDP Flooding attacks,
it can also support attacks such as Slowloris^[4], Goldeneye, and Hulk
DDoS.”

GoLang’s low development difficulties and its cross-platform
support have made the programming language a popular choice for
threat actors, the researchers added.

“The malware is being distributed actively via file sharing
websites such as Korean webhards,” AhnLab said. “As such, caution
is advised when approaching executables downloaded from a
file-sharing website. It is recommend[ed] for the users to download
products from the official websites of developers.”