BashLegend
active

BashLegend is an attack campaign operated by a hacker named UzzySenpai. Its first attack incidents were captured by Guardicore sensors in May 2020, however, its current wave started late August.
In this campaign, the hacker brute-forces public SSH servers. After a successful connection, the attacker downloads an executable file named .0803 from its command-and-control server.This file is an obfuscated version of an open-source tool called RootHelper, which “aids in the process of privilege escalation on a compromised Linux system”, according to its description on Github.
Afterwards, an XMRig Monero miner is downloaded alongside a JSON configuration. Since its emergence, we’ve observed only a single wallet being used – 89QZqpUHJBUJTYWKXxcHMrWrsJNVhKLUh2EmYd9KbBkmNhY6MNcJc8BJJ89QE621aLWuffSWHe2y7cA9up7t2kohJH42rWY.
BashLegend’s cryptominer names its workers using the number of CPU cores on the compromised machine – e.g. 1-Squad, 4-Squad, etc. – which gives us an insight into the nature of the victims. Some active workers are named 60-Squad, indicating that at least one victim with 60 CPU cores was hit by the attack.The strings observed in the attack files, combined with the first attack incidents which originated in Romania – strongly suggest that BashLegend operator is of Romanian origin.