Malware Spotlight: The Zergeca Botnet

Zergeca is a type of malware discovered in 2024. It is a network of infected machines (botnet) designed to carry out DDoS (distributed denial-of-service) attacks, but it also has capabilities far more extensive than those of traditional botnets. Developed in Golang, an open-source language created by Google, Zergeca shares characteristics with the Mirai botnet, particularly through the reuse of command-and-control (C2) infrastructure, suggesting a common creator or potential connections between the authors. Its name, inspired by “ootheca” (an insect egg capsule), discovered on its C2 servers, perfectly illustrates its ability to spread and infect a wide range of targets.

The life cycle of a machine infected with Zergeca—an advanced and modular piece of malware—unfolds in several key stages. Each phase represents a critical point in the exploitation of the compromised machine, from the initial infection to its eventual abandonment.

Diagram of the Life Cycle of a Machine Infected by the Zergeca Botnet

Initial Phase: Infection of the Machine

The first stage in the life cycle of a machine infected with Zergeca begins with the infection phase. The initial vector of infection can vary: a sophisticated phishing campaign, a drive-by download from a compromised website, or an exploit targeting unpatched vulnerabilities in common software.

Once the malware succeeds in executing code on the target machine, it typically performs a quick reconnaissance to ensure it is not in a sandboxing or analysis environment (for example, by detecting virtual machines or debugging tools). If no signs of analysis are detected, Zergeca proceeds to deploy its first module: persistence.

The persistence module in a nutshell:

The malware seeks to ensure its survival after the machine is restarted. Zergeca uses different techniques depending on the victim’s operating system: adding registry keys on Windows, or configuring init.d or systemd services on Linux-based systems. The goal is to ensure that Zergeca is restarted every time the computer boots up, thereby ensuring its long-term persistence.

Connection and Control Establishment Phase

After gaining initial access and ensuring persistence, Zergeca enters the phase of connecting to its command-and-control (C2) servers. This step is essential for establishing the link between the compromised machine and the cybercriminal’s infrastructure.

The initial connection is often concealed using encryption techniques (TLS) or proxies to avoid detection by network security systems. Zergeca can use a built-in proxy module to route its communications through intermediate nodes, making it more difficult to trace the C2 connection.

Check: Downloading Additional Modules

Once communication with the C2 server is established, Zergeca moves on to the control phase. This step involves downloading and installing additional modules based on the cybercriminal’s objectives. Zergeca is designed to be modular and adaptive, allowing the operator to dynamically load components depending on the compromised machine or the data they wish to exfiltrate. Among the modules frequently used are:

• Zombie Module: This module turns the infected machine into a bot that can be used for DDoS attacks or to relay malicious communications through a network of zombie machines.
• Silivaccine Module: This specific module disables antivirus and other security software by exploiting known vulnerabilities or by altering the behavior of the protection system.

Each module is downloaded and executed independently, making the malware flexible and capable of carrying out a wide range of malicious activities, from data exfiltration to the creation of botnets.

Removal of competing malware

Zergeca, like many advanced malware programs, also includes features to eliminate competing malware. This step may occur at the time of the initial infection or during the control phase, and is intended to maximize the resources available on the machine for Zergeca alone. The malware uses various techniques to detect and disable competing malicious processes, including monitoring open network ports and analyzing the signatures of executable files.

Eliminating competitors also reduces the risk of detection. If multiple pieces of malware coexist on a machine, the likelihood of detection by security software increases. Zergeca minimizes this risk by clearing the field.

Disinfection or Scrapping of the Machine

Once the cybercriminal’s objectives have been achieved, the machine may either be abandoned or cleaned by Zergeca itself. In some cases, if the malware determines that it has already collected enough data, or that the machine is about to be detected by antivirus software, it will trigger a self-destruct module to erase all traces of its presence . This process includes deleting its files, clearing system logs, and removing its registry keys or persistent services.

However, in other cases, Zergeca may simply abandon the machine while leaving its modules in place—particularly to maintain a backdoor that could be reactivated later. This strategy is often used when the malware anticipates a lapse in vigilance on the part of security teams or a future opportunity for exploitation.

The Zergeca botnet exploits several vulnerabilities listed in the Mitre Att&ck CVE database. Here is a summary table containing key information about the main vulnerabilities:

The Ikare and Reveelium solutions, developed by ITrust, offer advanced and complementary protection for businesses against malware such as the Zergeca botnet.

Ikare continuously assesses the security of corporate infrastructure by identifying exploitable vulnerabilities. In the face of a threat like Zergeca, which uses vulnerabilities to infect systems, Ikare plays a critical role in detecting potential vulnerabilities before they are exploited.

Reveelium is an AI-based solution that detects advanced threats such as botnets by analyzing abnormal network behavior. When faced with Zergeca, Reveelium identifies suspicious communications, predicts attacks using predictive analytics, and triggers automated responses to block the botnet and isolate infected machines.