New Mozi P2P Botnet Takes Over Netgear, D-Link, Huawei Routers

guest · Dec 23, 2019

New Mozi P2P Botnet Takes Over Netgear, D-Link, Huawei Routers
December 23, 2019
https://www.bleepingcomputer.com/ne...net-takes-over-netgear-d-link-huawei-routers/

Netgear, D-Link, and Huawei routers are actively being probed for weak Telnet passwords and taken over by a new peer-to-peer (P2P) botnet dubbed Mozi and related to the Gafgyt malware as it reuses some of its code.

The botnet is implemented using a custom extended Distributed Hash Table (DHT) protocol based on the standard one commonly used by torrent clients and other P2P platforms to store node contact info.
This makes it faster to establish the botnet's network without the need to use servers, as well as easier to "hide the valid payload in the vast amount of normal DHT traffic so detection is impossible without proper knowledge," as 360 Netlab found.
Propagation method and targeted devices
The malware uses telnet and exploits for propagation to new vulnerable devices by logging in to any targeted router or CCTV DVR that comes with a weak password, dropping and executing a payload after successfully exploiting unpatched hosts.

"After Mozi establishes the p2p network through the DHT protocol, the config file is synchronized, and the corresponding tasks are started according to the instructions in the config file," the researchers explain.
Click to expand...

P2P botnets increasingly more common
Until more details about Mozi surfaces and gets examined for potential weaknesses, the feasibility of a sinkholing attack against it is anyone's guess. Till then, Mozi has everything it needs to keep harvesting bots if the routers and other devices it targets won't be patched.
Click to expand...

360 Netlab: Mozi, Another Botnet Using DHT

guest · Sep 18, 2020

Mozi Botnet Accounts for Majority of IoT Traffic
Mozi’s spike comes amid a huge increase in overall IoT botnet activity
September 17, 2020
https://threatpost.com/mozi-botnet-majority-iot-traffic/159337/

The Mozi botnet, a peer-2-peer (P2P) malware known previously for taking over Netgear, D-Link and Huawei routers, has swollen in size to account for 90 percent of observed traffic flowing to and from all internet of things (IoT) devices, according to researchers.

IBM X-Force noticed Mozi’s spike within it’s telemetry, amid a huge increase in overall IoT botnet activity. Combined IoT attack instances from October through June is 400 percent higher than the combined IoT attack instances for the previous two years.

“Attackers have been leveraging these devices for some time now, most notably via the Mirai botnet,” according to IBM. “Mozi continues to be successful largely through the use of command-injection (CMDi) attacks, which often result from the misconfiguration of IoT devices. [...]”
It’s essentially a Mirai variant, but also contains snippets from Gafgyt and IoT Reaper – it’s used for DDoS attacks, data exfiltration, spam campaigns and command- or payload-execution.
Click to expand...

Mozi’s DHT Attack Routine
In Mozi’s case, the wget command downloads and executes a file called “mozi.a” on vulnerable systems, according to IBM. Researchers said that the file executes on a microprocessor. Once the attacker gains full access to the device through the botnet, the firmware level can be changed and additional malware can be downloaded, depending on the goal of any specific attack.
Mozi constantly updates the vulnerabilities that it tries to exploit via CMDi, banking on slow patch implementation, IBM noted.

“The Mozi botnet uses a customized DHT protocol to develop its P2P network,” according to IBM.
Click to expand...

“As newer botnet groups, such as Mozi, ramp up operations and overall IoT activity surges, organizations using IoT devices need to be cognizant of the evolving threat,” the firm concluded.
Click to expand...

IBM X-Force: A New Botnet Attack Just Mozied Into Town

A relatively new player in the threat arena, the Mozi botnet, has spiked among Internet of things (IoT) devices, IBM X-Force has discovered.
This malware has been active since late 2019 and has code overlap with Mirai and its variants. Mozi accounted for nearly 90% of the observed IoT network traffic from October 2019 through June 2020.
Click to expand...

guest · Nov 15, 2020

CERT-In Virus Alert
Mozi IoT Botnet
November 12, 2020
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVA01&VACODE=CIVA-2020-1793

It has been reported that a new malware named Mozi is affecting IoT devices globally. Affected IoT devices are being assembled into an IoT botnet which could be employed by botnet owner for launching distributed denial-of-service (DDoS) attacks, data exfiltration and payload execution.

According to the reports, Mozi malware is comprised of source code from Gafgyt, Mirai, and IoT Reaper; malware families which are targeting IoT devices. Mozi could compromise embedded Linux device with an exposed telnet. It mainly targets home routers and DVRs which are either unpatched, loosely configured or have weak/default telnet credentials. The infected devices form a peer-to-peer (P2P) botnet and uses a distributed hash table (DHT) to communicate with other infected host systems.
Click to expand...

guest · Aug 20, 2021

Mozi IoT Botnet Now Also Targets Netgear, Huawei, and ZTE Network Gateways
August 20, 2021
https://thehackernews.com/2021/08/mozi-iot-botnet-now-also-targets.html

Mozi, a peer-to-peer (P2P) botnet known to target IoT devices, has gained new capabilities that allow it to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE, according to new findings.

"Network gateways are a particularly juicy target for adversaries because they are ideal as initial access points to corporate networks," researchers at Microsoft Security Threat Intelligence Center and Section 52 at Azure Defender for IoT said in a technical write-up. "By infecting routers, they can perform man-in-the-middle (MITM) attacks—via HTTP hijacking and DNS spoofing—to compromise endpoints and deploy ransomware or cause safety incidents in OT facilities."
First documented by Netlab 360 in December 2019, Mozi has a history of infecting routers and digital video recorders in order to assemble them into an IoT botnet [...]

Mozi spreads via the use of weak and default telnet passwords as well as through unpatched IoT vulnerabilities, with the IoT malware communicating using a BitTorrent-like Distributed Hash Table (DHT) to record the contact information for other nodes in the botnet, the same mechanism used by file-sharing P2P clients.
Click to expand...

An IBM X-Force analysis published in September 2020 noted that Mozi accounted for nearly 90% of the observed IoT network traffic from October 2019 through June 2020 [...] In a separate investigation released last month, Elastic Security Intelligence and Analytics Team found that at least 24 countries have been targeted to date, with Bulgaria and India leading the pack.
Click to expand...

Microsoft: How to proactively defend against Mozi IoT botnet

Mozi is a peer-to-peer (P2P) botnet that uses a BitTorrent-like network to infect IoT devices such as network gateways and digital video records (DVRs). It works by exploiting weak telnet passwords1 and nearly a dozen unpatched IoT vulnerabilities2 and it’s been used to conduct distributed denial-of-service (DDoS) attacks, data exfiltration, and command or payload execution3.

While the botnet itself is not new, Microsoft’s IoT security researchers recently discovered that Mozi has evolved to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE. It does this using clever persistence techniques that are specifically adapted to each gateway’s particular architecture.
Click to expand...

Log in or Sign up

New Mozi P2P Botnet Takes Over Netgear, D-Link, Huawei Routers

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

New Mozi P2P Botnet Takes Over Netgear, D-Link, Huawei Routers

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches