MalwareMustDie, NPO is a
whitehat security research workgroup that was launched in August 2012. MalwareMustDie is a registered
nonprofit organization
A nonprofit organization (NPO) or non-profit organisation, also known as a non-business entity, not-for-profit organization, or nonprofit institution, is a legal entity organized and operated for a collective, public or social benefit, in co ...
as a medium for IT professionals and security researchers gathered to form a work flow to reduce
malware infection in the
internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
. The group is known for their malware analysis blog. They have a list of
Linux malware
Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but ...
research and botnet analysis that they have completed. The team communicates information about malware in general and advocates for better detection for
Linux malware
Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but ...
.
MalwareMustDie is also known for their efforts in original analysis for a new emerged malware or botnet, sharing of their found malware source code to the law enforcement and security industry, operations to dismantle several malicious infrastructure, technical analysis on specific malware's infection methods and reports for the cyber crime emerged toolkits.
Several notable internet threats that were first discovered and announced by MalwareMustDie are:
*Prison Locker (
ransomware)
*Mayhem (Linux botnet)
*Kelihos botnet v2
*ZeusVM
*Darkleech botnet analysis
*KINS (Crime Toolkit)
*Cookie Bomb (malicious
PHP
PHP is a general-purpose scripting language geared toward web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. The PHP reference implementation is now produced by The PHP Group. ...
traffic redirection)
*
Mirai
*LuaBot
*NyaDrop
*NewAidra or IRCTelnet
*Torlus aka Gafgyt/Lizkebab/Bashdoor/Qbot/
BASHLITE
BASHLITE (also known as Gafgyt, Lizkebab, PinkSlip, Qbot, Torlus and LizardStresser) is malware which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, b ...
)
*LightAidra
*PNScan
*STD Bot
*Kaiten botnets (
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, w ...
DDoS or malicious proxy
botnet
A botnet is a group of Internet-connected devices, each of which runs one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its conn ...
Linux malware
Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but ...
)
*ChinaZ (China
DDoS
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connec ...
Trojan)
*
Xor DDoS (China DDoS Trojan)
*IpTablesx (China DDoS Trojan)
*DDoSTF (China DDoS Trojan)
*DESDownloader (China DDoS Trojan)
*Cayosin DDoS botnet
*DDoSMan (China DDoS Trojan)
*AirDropBot DDoS botnet
*Mirai FBot DDoS botnet
*Kaiji IoT DDoS/bruter botnet
MalwareMustDie has also been active in analysis for client vector threat's vulnerability. For example,
Adobe Flash
Adobe Flash (formerly Macromedia Flash and FutureSplash) is a multimedia software platform used for production of animations, rich web applications, desktop applications, mobile apps, mobile games, and embedded web browser video players. Fla ...
(LadyBoyle SWF exploit) and other undisclosed Adobe vulnerabilities in 2014 have received Security Acknowledgments for Independent Security Researchers from Adobe. Another vulnerability researched by the team was reverse engineering a proof of concept for a backdoor case () of one brand of Android phone device that was later found to affect 2 billion devices.
Recent activity of the team still can be seen in several noted threat disclosures, for example, the "FHAPPI" state-sponsored malware attack, the finding of first ARC processor malware, and "Strudel" threat analysis (credential stealing scheme).
The team continues to post new Linux malware research on Twitter and their subreddit.
References
{{reflist
Security
White hat (computer security)