Mirai Botnet Infects Devices in 164 Countries

guest · May 18, 2018

The Satori Botnet Is Mass-Scanning for Exposed Ethereum Mining Rigs
May 18, 2018
https://www.bleepingcomputer.com/ne...ss-scanning-for-exposed-ethereum-mining-rigs/

The operators of the Satori botnet are mass-scanning the Internet for exposed Ethereum mining rigs, according to three sources in the infosec community who've observed the malicious behavior —SANS ISC, Qihoo 360 Netlab, and GreyNoise Intelligence.
Scans have been taking place for almost a week
The scans started on May 11, according to researchers from Netlab, the first to observe them, and the ones who tied their activity to the Satori botnet.
GPON routers used to scan and compromise mining rigs
GreyNoise also tied the scans to a group of IP addresses located in Mexico, on the networks two ISPs that just a few days earlier had thousands of GPON routers compromised and attacked by five different botnets.

Based on the current evidence, Satori, one of the five botnets, was using the GPON routers to scan for Claymore miners, deploy an exploit, and hijack the devices to mine Ethereum and Decred cryptocurrencies for the Satori operators.

Yesterday, Netlab researchers published a blog post confirming GreyNoise's initial discovery.
Click to expand...

itman · May 21, 2018

New Mirai Variant Adds Three Exploits

Security experts are warning of a new Mirai variant which features three exploits to target unpatched IoT endpoints.

The “Wicked” variant is named after some of the code strings found in it by researchers at Fortinet, they revealed late last week.

If connected to Port 8080, the malware will use a remote code execution (RCE) Netgear exploit which works on DGN1000 and DGN2200 v1 routers, and is the same tool used by the Reaper botnet to compromise target machines.

For Port 81, an RCE exploit is used that targets CCTV and DVR devices.

An old command injection vulnerability (CVE-2016-6277) is exploited via Port 8443 to compromise Netgear R7000 and R6400 devices.

For Port 80, the black hats have added a technique which hijacks compromised web servers with malicious web shells already installed.

“After a successful exploit, this bot then downloads its payload from a malicious website, in this case, hxxp://185.246.152.173/exploit/owari.{extension}. This makes it obvious that it aims to download the Owari bot, another Mirai variant, instead of the previously hinted at Sora bot,” explained Fortinet.
Click to expand...

https://www.infosecurity-magazine.com/news/new-mirai-variant-adds-three/

itman · May 21, 2018

Mirai-variant attack launched from Mexico

A pair of Trend Micro research teams has detected and done a quick cyber autopsy on a new Mirai-like attack that popped up in Mexico earlier this month targeting Gigabit Passive Optical Network (GPON) home routers and IP webcams.

The attacks, which ran from May 8-10, sprang from 3,845 IP addresses located in Mexico and targeted routers and webcams using default passwords. Once the IoT device is entered the threat actors use CVE-2018-10561 or CVE-2018-10562 to inject malware that can enable remote code execution. Four variants of the malware are used targeted at different processor architectures ARM, ARMv7, MIPS and MIPS little-endian.
Click to expand...

https://www.scmagazine.com/mirai-variant-attack-launched-from-mexico/article/767506/

Related: https://www.bleepingcomputer.com/news/security/gpon-routers-attacked-with-new-zero-day/

guest · Jun 4, 2018

Hacker Fail: IoT botnet command and control server accessible via default credentials
June 4, 2018
https://blog.newskysecurity.com/hac...cessible-via-default-credentials-2ea7cab36f72

In an irony of epic proportions, we observed that an IoT botnet variant, Owari, which relies on default/weak credentials to hack IoT devices was itself using default credentials in its command and control server, allowing read/write access to their server database.
Owari’s MySQL database
Mirai botnet was designed to set up a MySQL server for the command and control containing three tables, namely users, history, and whitelist. While IoT botnets have evolved and many of them have different attack vectors, most of them still retain this tried and tested MySQL server structure, and Owari is no exception to this.

We observed few IPs attacking our honeypots with default credentials [...] We tried to investigate more into this IP. To our surprise, it is connected to the attacker’s servers using one of the weakest credentials known to mankind.

Username: root
Password: root
Click to expand...

guest · Jun 7, 2018

7 Variants (So Far) of Mirai
Mirai is an example of the newest trend in rapidly evolving, constantly improving malware. These seven variants show how threat actors are making bad malware worse.
June 7, 2018
https://www.darkreading.com/vulnerabilities---threats/7-variants-(so-far)-of-mirai/d/d-id/1331953

Change, as we know, is the only constant. Malware – which is evolving rapidly, sprouting new features and functionality, and becoming more difficult to find and eradicate – is no exception to the rule.
One of the most notable examples is Mirai, botnet malware first described in August 2016. Mirai quickly won notoriety as the engine for some of the largest DDoS attacks seen to date.

Mirai will likely continue to evolve and develop. It has also shown to the malware market the possibility of rapid code evolution and an agile mindset. The question for the security world is whether the defender can evolve as quickly, or as effectively, as the attacker.
Click to expand...

guest · Jun 15, 2018

Botnets never Die, Satori REFUSES to Fade Away
June 15, 2018
https://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/

Two days ago, on 2018-06-14, we noticed that an updated Satori botnet began to perform network wide scan looking for uc-httpd 1.0.0 devices. Most likely for the vulnerability of XiongMai uc-httpd 1.0.0 (CVE-2018-10088). The scanning activities led to a surge in scanning traffic on ports 80 and 8000.

About three hours ago, as we were writing this article, the Satori author released yet another update.
The Recent 80 and 8000 Ports Scan Traffic Upticks
This new variant caused scan traffic upticks on ports 80 and 8000, as can be seen on our ScanMon system, the two traffic growth start times are 2018-06-09 and 2018-06-14 respectively.
Satori is Collecting the IP Address of the uc-httpd 1.0.0 Devices
Satori is collecting the IP address of the device fingerprint "uc-httpd 1.0.0" by scanning the 80/8000 port on the internet. The relevant pseudo code is as follows. Once a matching target is found, its IP is reported to 180.101.204.161:48101. [...]
Click to expand...

guest · Jun 21, 2018

Widely used D-Link modem/router under mass attack by potent IoT botnet
Satori unleashes worm exploiting 2-year-old vulnerability in DSL-2750B devices.
June 20, 2018
https://arstechnica.com/information...outer-under-mass-attack-by-potent-iot-botnet/

Malicious hackers are mass exploiting a critical vulnerability in D-Link DSL routers in an attempt to make them part of Satori, the potent Internet-of-things botnet that is used to take down websites and mine digital coins, researchers said.

It’s not immediately clear what people with a vulnerable D-Link device can do to protect themselves from these attacks. Ars has asked both D-Link and Radware to provide guidance. In the meantime, people using one should strongly consider replacing it.
Click to expand...

guest · Jul 20, 2018

IoT hacker builds Huawei-based botnet, enslaves 18,000 devices in one day
A hacker has taken only 24 hours to build a botnet which is at least 18,000-devices strong.
July 20, 2018
https://www.zdnet.com/article/iot-hacker-builds-huawei-based-botnet-using-18000-devices-in-one-day/

First spotted by researchers from NewSky Security, as reported by Bleeping Computer, other security firms including Rapid7 and Qihoo 360 Netlab quickly jumped on the case and confirmed the existence of the new threat.

The traffic surge was due to scans seeking devices vulnerable to CVE-2017-17215, a critical security flaw which can be exploited through port 37215.

In the case of the new Huawei-based botnet, a hacker calling themselves "Anarchy" has claimed responsibility, according to NewSky Security's Ankit Anubhav.

Anubhav suspects that Anarchy may be the same hacker known as Wicked, who has been linked with the creation of the Owari/Sora botnets.
Click to expand...

ronjor · Aug 23, 2018

New Mirai Variants Leverage Open Source Project

Dark Reading Staff 8/23/2018
Aboriginal Linux gives Mirai new cross-platform capabilities - including Android.
Click to expand...

guest · Sep 11, 2018

Apache Struts exploit found in Mirai variant may signify shift in attack strategy
September 10, 2018
https://www.scmagazine.com/home/new...variant-may-signify-shift-in-attack-strategy/

Researchers for the first time have discovered a variant of the Mirai Internet of Things botnet that targets an vulnerability found in unpatched versions of the open-source Apache Struts web app development platform.

That bug is none other than the infamous CVE-2017-5638, a remote code execution flaw that was exploited in the Equifax data breach, according to a Sept. 9 blog post from Palo Alto Networks’ Unit 42 threat research division.

CVE-2017-5638 is actually just one of 16 vulnerabilities that the Mirai variant abuses, including RCE and command injections bugs in a wide variety of networking devices, routers, CCTVs and DVRs.

Unit 42 researchers uncovered samples of the Mirai variant on Sept. 7, tracing the threat to a pair of malicious domains, one of which was used in August to spread a new version of a second IoT botnet called Gafgyt.
Click to expand...

guest · Sep 19, 2018

Dissecting the first Gafgyt bot implementing the “Non Un-Packable” NUP technique
September 19, 2018
https://securityaffairs.co/wordpress/76362/malware/gafgyt-bot-nup-technique.html

A new variant of the Gafgyt botnet is spreading in the last hours and experts of the CSE Cybsec Z-Lab have found it with the support of the Italian cyber security experts @Odisseus and GranetMan.

The new variant analyzed in the report published by the experts was found on a system resolving the IP address owned by the Italian ISP Aruba. This specific version implements some advanced packing techniques that make the static analysis much harder.

Malware Must Die leader @unixfreaxjp presented the sophisticated technique at the recent Radare conference (r2con2018) in his talk about the “Non Un-Packable” packer.

According to the experts the “Non Un-Packable” ELF was around since a few months before the talk and our discovery confirms that malware developers started adopting it.
Click to expand...

ZLAB Malware Analysis Report (PDF): http://csecybsec.com/download/zlab/20180919_CSE_Gafgyt_v2.pdf

guest · Oct 26, 2018

16K Strong DDoS-for-Hire Botnet Provides 420+ GB/s Club to Knock Out Websites
Yet another Mirai fork that kills other bots on sight
October 26, 2018
https://news.softpedia.com/news/16k...-gb-s-club-to-knock-out-websites-523461.shtml

[...] the Bushido botnet which, as FortiGuard Labs team reports, was first detected on September 17 and it is a built using a lot of code from Mirai's leaked source code.

Furthermore, Bushido also uses a different set of user/passwords combinations which enables it to target devices not yet in the crosshairs of other Mirai forks.
Mirai forks with very little modifications can be used by crooks to build huge botnets that can do a lot of damage in very little time
While based on Mirai, Bushido comes with three new DDoS attack options that, unsurprisingly, might also be borrowed from the leaked source code of another Mirai fork dubbed Owari.

Bushido's most exciting behavior is its enduring interest in hunting down other bots running on machines it manages to compromise and obliterating them out of existence by killing them on sight.
Click to expand...

guest · Dec 20, 2018

With Mirai Comes Miori: IoT Botnet Delivered via ThinkPHP Remote Code Execution Exploit
December 20, 2018
https://blog.trendmicro.com/trendla...d-via-thinkphp-remote-code-execution-exploit/

We analyzed another Mirai variant called “Miori,” which is being spread through a Remote Code Execution (RCE) vulnerability in the PHP framework, ThinkPHP.

Aside from Miori, several known Mirai variants like IZ1H9 and APEP were also spotted using the same RCE exploit for their arrival method. The aforementioned variants all use factory default credentials via Telnet to brute force their way in and spread to other devices. Once any of these Mirai variants infects a Linux machine, it will become part of a botnet that facilitates distributed denial-of-service (DDoS) attacks.
Click to expand...

guest · Jan 17, 2019

New Attacks Target Recent PHP Framework Vulnerability
January 17, 2019
https://www.darkreading.com/vulnera...nt-php-framework-vulnerability/d/d-id/1333676

Last month a code execution vulnerability was found in the ThinkPHP framework, a rapid-development framework developed by Chinese firm TopThink.
"I realized there was a software framework developed in China that had this vulnerability, and it was being taken advantage of to install coin miners and skimmers," Cashdollar says.

In a blog post describing the new attacks, Cashdollar wrote that multiple threat actors are using relatively simple techniques to take advantage of the vulnerability.
He pointed out that a single line of code can scan for the presence of the vulnerability, which can then be exploited with attacks involving simple cut-and-paste code that is widely available.

One of the payloads Cashdollar has seen delivered is a Mirai variant – a development he has worried about, he says. "I had been waiting for Mirai botnet kits to include Web app code in their arsenal," he says, "and this was an indicator that it's happening."
Click to expand...

guest · Jan 25, 2019

mood said: ↑

New Attacks Target Recent PHP Framework Vulnerability
Click to expand...

Hakai and Yowai botnets abuse ThinkPHP vulnerabilities
January 25, 2019
https://www.scmagazine.com/home/sec...mework-to-expand-the-hakai-and-yowai-botnets/

Cybercriminals are exploiting vulnerabilities in the ThinkPHP open source framework to expand the Hakai and Yowai botnets.

The botnets can be used to breach web servers and launch DDoS attacks against websites using a vulnerability in the framework’s invokeFunction method to execute malicious code on the underlying server, Trend Micro researchers said in a Jan. 25 blog post.

Researchers said the Hakai sample they observed explored flaws that may have remained unpatched in the system and and that as more botnet codes become available and exchanged online they expect to see more competing Mirai-like botnets in these kind of intrusions.
Click to expand...

guest · Mar 18, 2019

New Mirai Variant Targets Enterprise Wireless Presentation & Display Systems
March 18, 2019
https://unit42.paloaltonetworks.com...rprise-wireless-presentation-display-systems/

This new variant that Unit 42 discovered is notable for targeting different embedded devices like routers, network storage devices, NVRs, and IP cameras and using numerous exploits against them.

In particular, Unit 42 found this new variant targeting WePresent WiPG-1000 Wireless Presentation systems, and in LG Supersign TVs. Both these devices are intended for use by businesses. This development indicates to us a potential shift to using Mirai to target enterprises.
In addition to this newer targeting, this new variant of Mirai includes new exploits in its multi-exploit battery, as well as new credentials to use in brute force against devices.

These new features afford the botnet a large attack surface. In particular, targeting enterprise links also grants it access to larger bandwidth, ultimately resulting in greater firepower for the botnet for DDoS attacks.
Click to expand...

guest · Apr 8, 2019

Mirai developers target embedded systems processors
April 8, 2019
https://www.scmagazineuk.com/mirai-developers-target-embedded-systems-processors/article/1581382

Security researchers have discovered new variants of the Mirai malware targeting different processor architectures.

According to a blog post by researchers at Palo Alto Networks, these new variants have been compiled for Altera Nios II, OpenRISC, Tensilica Xtensa, and Xilinx MicroBlaze processors. These types of processors are usually found in embedded systems.
"If the latest innovations lead to an increase in the number of infected devices, that means that Mirai attackers would have access to additional firepower for use in denial of service attacks," said researchers.
Click to expand...

guest · May 6, 2019

A bug in Mirai code allows crashing C2 servers
Ankit Anubhav, a principal researcher at NewSky Security, explained how to exploit a vulnerability in the Mirai bot to crash it
May 6, 2019
https://securityaffairs.co/wordpress/85040/malware/mirai-servers-hack.html

The expert pointed out that a Mirai C2 server crashes when someone connects it using as username a sequence of 1025+ “a” characters.

Analyzing a part of the Mirai source code available on Github the experts noticed that the username is passed to the Readline custom function. This function declares a fixed buffer size length of 1024, for this reason, providing an input greater than 1024 will cause the module crashes.

“Since a majority of IoT botnets even in 2019 are based of Mirai, this vulnerability has been passed out in many of the variants and is already used in full force among Blackhats. ” explained Ankit Anubhav.
Some threat actors in the wild are aware of this bug in Mirai code and used it to crash the C2 servers of the rivals,

The expert concluded discouraging the practice of crashing all known C2 servers in a loop because it is illegal, instead, it suggests to report them to the police, CERTs and ISPs.
Click to expand...

guest · May 24, 2019

New Mirai Variant Uses Multiple Exploits to Target Routers and Other Devices
May 23, 2019
https://blog.trendmicro.com/trendla...exploits-to-target-routers-and-other-devices/

We discovered a new variant of Mirai (detected as Backdoor.Linux.MIRAI.VWIPT) that uses a total of 13 different exploits, almost all of which have been used in previous Mirai-related attacks.

Looking into the new variant’s code revealed more details about how it spreads, specifically the 13 different exploits it uses. The first three exploits, shown in Figure 2, are the scanners for specific vulnerabilities found in the web development format ThinkPHP and certain Huawei and Linksys routers. The scanners for the remaining 10 vulnerabilities used in this attack, shown in Figure 3, can be found inside exploit_worker().

We found that aside from spreading through these vulnerabilities, this Mirai variant also has brute-force capabilities using several common credentials [...]
The exploits
These exploits take advantage of flaws found in routers, surveillance products, and other devices. Of these exploits, 11 had already been used together in 2018 by the Mirai variant Omni, according to a report by Unit 42.
Click to expand...

guest · Jun 10, 2019

New Mirai variant targets new devices for botnet including SD-WAN
June 10, 2019
https://www.scmagazineuk.com/new-mi...vices-botnet-including-sd-wan/article/1587004

A new variant of Mirai has been discovered that uses exploits against a wide range of embedded devices.
According to a blog post by security researchers at Palo Alto Networks, the malware targets devices ranging from wireless presentation systems to set-top-boxes, SD-WANs, and even smart home controllers.

Researchers said that the latest variant contains a total of 18 exploits, eight of which are new to Mirai.
[...] this newly discovered variant is a continuation of efforts by Linux malware authors to scout for a wider range and thus, larger number, of IoT devices to form larger botnets thereby affording them greater firepower for DDoS attacks.
"Based on the results observed by using such variants, the exploits that are more effective ie the ones that infect a greater number of devices are retained or reused in future variants whereas the less effective ones are retired or replaced by malware authors with other exploits," said researchers.
Click to expand...

guest · Jul 11, 2019

Updated Miori Botnet C2 Server Tells Researchers to F*** Off
July 11, 2019
https://www.bleepingcomputer.com/ne...-botnet-c2-server-tells-researchers-to-f-off/

A new version of the Miori botnet added protection to the login panel of its command and control server, hanging a "not welcome" message for connections likely coming from a security researcher.
Researchers not welcome
Until the latest variant, Miori's communication with the command and control (C2) server relied on a binary-based protocol with a login prompt available to anyone that knew the address.
It appears that cybercriminals have grown familiar with the way malware analysts do their research and added a message for them when they connected to the C2 via the normal methods.

The new Miori variant has support for encrypted commands and is allowed to connect to the command server only after sending the specific string.
Makoto Shimamura of Trend Micro says that while it awaits instructions, the malware continues to search for vulnerable hosts that can be compromised.
Source code for sale
Whoever is behind this new variant of Miori appears to offer the source code to anyone willing part with $110. This may be part of a future plan from the developer as the strings for the website address were found inside the malware sample.
Click to expand...

Trend Micro: New Miori Variant Uses Unique Protocol to Communicate with C&C

guest · Jul 18, 2019

Mirai malware sets sights on enterprise IoT devices ripe for picking
July 18, 2019
https://www.scmagazine.com/home/sec...s-since-set-its-sights-on-enterprise-devices/

IBM X-Force researchers have noted a sharp uptick in Mirai activity, with a spike starting in November 2018, and a doubling between the first quarter of 2018 and the first quarter of 2019, according to a blog post.

Researchers say these new variants have the potential to impact cloud servers and heavily compromise information and insurance services and more. As a result, connected devices at the enterprise level including medical devices, utility company meters, robots tracking warehouse inventory, and other devices are at risk.

“Historically, simpler internet of things (IoT) devices such as routers and CCTV cameras were most affected, but recent IBM X-Force data indicates that threat actors are increasingly targeting enterprise devices,” researchers wrote in the post.
Researchers warn the threat has gone beyond consumer products and that network defenders should begin taking measures to protect their IoT devices which may be exploited by Mirai.
Click to expand...

IBM X-Force: I Can’t Believe Mirais: Tracking the Infamous IoT Malware

guest · Aug 1, 2019

Keeping a Hidden Identity: Mirai C&Cs in Tor Network
July 31, 2019
https://blog.trendmicro.com/trendla...g-a-hidden-identity-mirai-ccs-in-tor-network/

Despite all the attention that the malware has received, it seems cybercriminals are still continually developing and using this malware.
Compared to previous variants, however, we found this sample distinct because the cybercriminals placed the command and control (C&C) server in the Tor network for anonymity.

This may be a developing trend among IoT malware developers, given that malicious actors’ C&C servers in the surface web can be reported and taken down — and it’s one trend that cybersecurity researchers, enterprises, and users alike may have to start defending against.
Likewise, the server remains running despite discovery, network traffic can masquerade as legitimate and remains encrypted, and it may not necessarily be blacklisted due to other possible legitimate uses for Tor.
Click to expand...

Minimalist · Sep 12, 2019

Mirai descendants dominate IoT threat environment

Attacks leveraging compromised IoT devices are growing in size, scale and frequency, report security experts at F-Secure and Trend Micro, with Mirai-related botnets a major source of trouble
Click to expand...

https://www.computerweekly.com/news/252470509/Mirai-descendants-dominate-IoT-threat-environment

Minimalist · Sep 12, 2019

It's Time for IoT Security's Next Big Step

The Internet of Things security crisis has persisted for decades, producing a seemingly endless stream of under-secured consumer gadgets, corporate phones, printers, networking equipment, medical devices, and critical infrastructure sensors and controllers. By now, every industry has an IoT albatross around its neck. And though new devices are increasingly equipped with basic security protections, those minimum standards are just the beginning.
Click to expand...

https://www.wired.com/story/iot-security-next-step/

Log in or Sign up

Mirai Botnet Infects Devices in 164 Countries

guest Guest

itman Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Mirai Botnet Infects Devices in 164 Countries

guest Guest

itman Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Useful Searches