New Kraken botnet is allowing operators to earn USD 3,000 every month

Researchers spotted a new Golang-based botnet called Kraken that is under active development and supports a lot of backdoor capabilities.

Kraken is a new Golang-based botnet discovered in late October 2021 by researchers from threat intelligence firm ZeroFox Intelligence. Experts pointed out that despite having the same name, this botnet should not be confused with the Kraken botnet that was spotted in 2008.

The botnet appears to be under active development, it supports a broad range of backdoor capabilities, such as the ability to download and execute secondary malicious payloads and run shell commands.

It currently uses the SmokeLoader loader to install other malicious payloads.

Kraken attack chain initially leveraged self-extracting RAR SFX files downloaded by SmokeLoader. These SFX files contained a UPX-packed version of Kraken, RedLine Stealer, and another binary used to delete Kraken. New versions of Kraken are downloaded by SmokeLoader directly.

“Thanks to a tip by @abuse_ch, ZeroFox learned that Kraken originally spread in self-extracting RAR SFX files downloaded by SmokeLoader. These SFX files contained a UPX-packed version of Kraken, RedLine Stealer, and another binary used to delete Kraken.” reads the analysis published by ZeroFox. “Current versions of Kraken are now downloaded by SmokeLoader directly. Kraken binaries are still UPX-packed but are now further protected by the Themida packer as well.”

The early variants of the Kraken bot have been found to be based on source code available on GitHub, but at this time it is unclear if the code was uploaded by the botnet operators.

Experts spotted multiple versions of the administration panel or dashboard since October 2021. The code uploaded on GitHub did include a server, but it did not have a web-based interface to manage the botnet.

Kraken’s authors are constantly updating their code by implementing new features. Current versions could steal a broad range of info from the infected host and target wallets from multiple platforms, including Armory, Atomic Wallet, Bytecoin, Electrum, Ethereum, Exodus, Guarda, Jaxx Liberty, and Zcash. It leverages the RedLine Stealer to siphon credentials, credit card data, cookies, autocomplete information stored in browsers, cryptocurrency wallets, credentials stored in VPN clients and FTP clients. 

According to the experts, the Kraken botnet is allowing operators to earn around USD 3,000 every month.

“While in development, Kraken C2s seem to disappear often. ZeroFox has observed dwindling activity for a server on multiple occasions, only for another to appear a short time later using either a new port or a completely new IP.” concludes the report. “It is currently unknown what the operator intends to do with the stolen credentials that have been collected or what the end goal is for creating this new botnet,”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Kraken botnet)