Whitepaper: FritzFrog P2P Botnet Fileless Malware

ABSTRACT

The number of organisations adapting to working from home has seen a significant increase in recent times. This has led to an increase in Virtual Private Networks (VPNs) being adopted resulting in an extended network perimeter, with employees connecting to their work networks not only from their work laptops, but also from their own computer systems at home through remote desktops. This has resulted in RDP (Remote Desktop Protocol) and phishing attacks becoming a more commonly exploited threat vector, whilst fileless malware is becoming a more utilised delivery method.

WHAT IS FRITZFROG P2P BOTNET?

FritzFrog is suspected to have been in operation since January 2020. Written from scratch in Golang, it is a sophisticated P2P designed worm that has been actively brute-forcing its way into not only SSH servers but also Linux-based devices, corporate servers, routers and IoT devices in order to propagate and further corral other devices into its expanding botnet.