Security Posture Report - July 2025

1. Platform attack and defense posture

Default defense level of the cloud platform

Daily average for July 2025

• Defended against 4.7 billion attacks, a 6.7% decrease from June.

• Defended against 30,000 attacking IP addresses, a 3.1% increase from June.

DDoS attack interceptions

In July, the Alibaba Cloud platform detected and blocked a total of

• 114,000 DDoS attacks, a 25.9% decrease from the previous month.

• Peak DDoS attack traffic of 1600 Gbps, a 5.88% decrease from the previous month.

2. Recent attack methods and trends

Trend 1: New threat actor group uses distributed brute-force strategy to infect hosts

Recently, the Alibaba Cloud security team detected a new mining worm group on the cloud platform. This group primarily spreads through Secure Shell (SSH) brute-force attacks. Unlike typical worms, this group uses a distributed brute-force strategy to enhance its propagation capabilities. Based on its Indicators of Compromise (IOCs), we have named this group Luotuoxiangzi.

Attack method

Luotuoxiangzi first compromises a host through an SSH brute-force attack. It then downloads a program named ddaemon, which acts as a loader for subsequent operations. This loader performs the following actions:

1. Establishes persistence on the system by registering itself as a system service.

2. Downloads a mining configuration script and starts cryptocurrency mining.

3. Downloads a scanning tool to attack other targets for self-propagation.

Unlike traditional worms, Luotuoxiangzi does not carry its own dictionary for brute-forcing passwords or randomly generate attack targets. Instead, it:

• Downloads brute-force dictionaries and target lists from a central server to perform distributed brute-force attacks.

• Frequently changes the target list and regularly updates the dictionary, making the attacks more flexible and powerful.

This method allows Luotuoxiangzi to conduct many diverse brute-force attempts in a short time, which makes it spread faster and harder to defend against than traditional worms.

IOCs

1) Related samples:

• bfa742a7971ee767136a506cbd9dac48

• ff5de82d58353f5bfe6257a4105beb29

• c5c3fcdaed9b76e1f186c797be3d9d04

• 21b12dbf8795d2fcdd1ad1dbdc4fb80a

• e958c454e3599726b2863670054ce0dd

2) C2 addresses:

• db.luotuoxiangzi.cc

• dow.luotuoxiangzi.cc

Security recommendations

1. Use Alibaba Cloud SSH key pairs to log on to Linux instances. This improves the security of remote access.

2. If you must use passwords for business reasons, use complex security tokens that include numbers, letters, and symbols. Avoid exposing security groups to the public network. If you receive a weak security token alert from an Alibaba Cloud security assessment, it means the password strength for the instance is too low or the password has been compromised. Change the password immediately.

3. If Alibaba Cloud detects a suspected intrusion threat on a host, it sends a security alert that contains keywords such as "hacker intrusion". Follow the instructions in the alert to address the issue immediately.

Trend 2: Cybercriminals use phishing with O&M tools to steal Elastic Compute Service logon credentials in batches

Recently, the Alibaba Cloud security team has observed a group named "Yexiao" expanding its activities on the cloud platform. This group primarily uses highly convincing phishing websites to trick users into downloading malware. This allows the group to gain control of servers and use these compromised servers for broader network attacks or illegal activities.

Attack method

The attackers use phishing websites and malicious scripts disguised as Baota Panel, a server management software. The attack proceeds as follows:

1. Trick users into downloading a malicious installation script: The attackers create a phishing website that looks nearly identical to the official Baota Panel website and promote it through search engines. When users search for "Baota", they might mistakenly click this fake site and download a seemingly normal installation script.

2. Execute the malicious script: Once a user executes the malicious script, it downloads and runs virus files, such as lcsys, on the user's server. These files attempt to hide themselves and are configured to start automatically to maintain persistence.

3. Establish a back door connection: The malware communicates with a remote control server through a heartbeat mechanism. This allows attackers to control the infected server at any time. The program also sends sensitive information from the server, such as the Baota Panel username and password, to specific malicious domain names.

4. Continuous monitoring and propagation: In addition to causing direct damage, the attackers may use the compromised server as a springboard to attack other targets or add it to a botnet. The botnet can then be used to launch additional network attacks or perform mining activities.

IOCs

1) Related samples

• f68db8a062ed1ca03f2a90eaebf5c83e

• 4d5fd87abdcaaecee225f02a7db6a47e

2) C2 addresses

• xz.appdoner.com

• bt.jcjydzsw.cn

• btlude.appokset.com

• lilforfdwes14dffljiul.com

3) Phishing websites (partial list)

• skqq.jcjydzsw.cn

• dolowdeopen.com

Security recommendations

1. Improve your network security awareness. Download and install software only from official and trusted sources to prevent malware infections.

2. Alibaba Cloud will continue to monitor the spread of this group. If you receive a security alert that contains keywords such as "hacker intrusion", follow the instructions in the alert to address the issue immediately.

3. Vulnerabilities frequently attacked recently

Based on attack data analytics, the Alibaba Cloud security team has identified the vulnerabilities that were most frequently scanned and exploited on the cloud platform recently. If your assets are affected, we recommend that you detect and fix these vulnerabilities or implement protective measures immediately.

The following vulnerabilities were frequently attacked on Alibaba Cloud in July:

Free detection is available for most of these vulnerabilities. You can go to the Alibaba Cloud Security Center console and enable the free security assessment to scan for emergency vulnerabilities.

For more security information, subscribe to the Cloud Security Guide channel.