A script collected system information from computers, sending it back to the C2 server. A second script, a GammaSteel variant, exfiltrated files with specific extensions from directories using PowerShell web requests. If unsuccessful, it used cURL command line tool with a Tor proxy. The web service write.as may have been an alternative data exfiltration channel.
Experts Uncover New XorDDoS Controller, Infrastructure as Malware Expands to Docker, Linux, IoT
Cybersecurity researchers have highlighted the ongoing risk posed by XorDDoS, a distributed denial-of-service malware that has targeted the US in 71.3% of attacks from November
