Open Directory Exposure Leaks BYOB Framework Across Windows, Linux, and macOS
An investigation has uncovered an exposed command-and-control server hosting a full deployment of the BYOB (Build Your Own Botnet) framework. This sophisticated post-exploitation tool targets Windows, Linux, and macOS systems.
An investigation has uncovered an exposed command-and-control server hosting a full deployment of the BYOB (Build Your Own Botnet) framework. This sophisticated post-exploitation tool targets Windows, Linux, and macOS systems.
The discovery, facilitated by Hunt.io's AttackCapture tooling, identifies an active campaign that has been operational for approximately ten months. This campaign utilizes multi-platform remote access capabilities and incorporates cryptocurrency mining operations.
The exposed open directory was found on IP address 38[.]255[.]43[.]60 port 8081, a server hosted by Hyonix in Los Angeles.
Analysis indicated that the server distributed malicious payloads, including droppers, stagers, and full remote access trojans designed to compromise multiple operating systems.
The infrastructure comprises five C2 nodes located in the United States, Singapore, and Panama, with documented activity beginning in March 2024.
Further investigation revealed a dual-purpose operation. Two of the five command and control servers hosted both BYOB framework components and XMRig cryptocurrency mining software. This suggests that threat actors combined remote access capabilities with cryptojacking for passive revenue generation.
The affected dual-use nodes were located at 15[.]235[.]186[.]150 in Singapore and 108[.]230[.]121[.]11 on a US AT&T network.
The primary C2 server exhibited a unique configuration with multiple web servers running concurrently, including IIS 10.0 on standard HTTP/HTTPS ports, Apache 2.4.41 on port 8080, and Python SimpleHTTP on port 8081 for payload distribution.
An exposed RDP port (3389) has been active since December 2023, suggesting dedicated attack infrastructure rather than compromised legitimate systems.
The BYOB framework employs a three-stage infection chain designed to evade detection while establishing persistent remote access.
An investigation has uncovered an exposed command-and-control server hosting a full deployment of the BYOB (Build Your Own Botnet) framework.
Stage one involves a compact 359-byte Python dropper using several obfuscation layers, such as Base64 encoding, Zlib compression, and Marshal serialization.
This dropper retrieves a 2KB stager that conducts anti-virtualization checks by scanning for VirtualBox, VMware , and Hyper-V indicators in environment variables and running processes.
After passing security checks, the stager retrieves the final 123KB payload containing the full remote access trojan.
The stager serves as an intermediate loader performing critical security checks before deploying the main payload. This separation ensures the full 122KB payload is never exposed to analysis environments.
The malware disguises itself as "Java-Update-Manager" to appear legitimate and implements seven distinct persistence mechanisms across all three target platforms.
On Windows, it uses Registry Run Keys and Startup folder shortcuts. Linux systems are compromised through crontab entries, while macOS devices are infected via LaunchAgent plist files.
The exposed framework includes extensive post-exploitation modules offering keylogging with window context tracking, screenshot capture, Outlook email harvesting using COM automation, raw packet sniffing for network traffic interception, and process manipulation capabilities.
The malware can terminate security software, bypass Windows User Account Control prompts, and maintain encrypted HTTP-based command and control communications.
Analysis of captured payloads confirms the framework performs comprehensive system reconnaissance, including public IP discovery through api[.]ipify[.]org, geolocation queries to ipinfo[.]io, and collection of hostname, username, MAC address, and privilege level information.
These capabilities enable threat actors to profile victims and determine valuable targets for further exploitation or data exfiltration operations.
Type Value Description
IP Address 38[.]255[.]43[.]60 C2 server (Hyonix, US)
Port 8081 HTTP file server / module distribution
Port 8080 Primary C2 command channel
Port 8082 Package distribution server
Port 8083 File upload handler
Based on reporting by GBHackers.