Ancient Propose Change

According to KSI Digital, "ancient" is a Linux IoT botnet that uses a custom "ANCT" command-and-control protocol rather than the Mirai protocol, although several feeds initially mislabeled it as Mirai. It is delivered via Telnet compromise and a shell dropper that supports 13 architecture builds, with persistence achieved through cron, rc.local, init.d, and profile.d modifications. The bot evades analysis by staying dormant while traced via ptrace, and it conceals its C2 domain lookup using DNS-over-TLS to a public resolver. Its C2 handshake involves an "ANCT" tag followed by a key exchange and encrypted communication, and it is written to run on BusyBox-style shells with an emphasis on pure ASCII compatibility.

References

There is no Yara-Signature yet.