BotenaGo botnet targets millions of IoT devices with 33 exploits

guest · Nov 11, 2021

BotenaGo botnet targets millions of IoT devices with 33 exploits
November 11, 2021
https://www.bleepingcomputer.com/ne...ets-millions-of-iot-devices-with-33-exploits/

The new BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.

BotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.
In the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.
Click to expand...

Targeting millions of devices
BotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below: [...]

Researchers at AT&T who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.
An example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.
Click to expand...

Depending on which device is targeted, the malware uses different links to fetch a matching payload.

In conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the intention of its authors.

Fortunately, the new botnet has been spotted early, and the indicators of compromise are already available. Still, as long as there's a wealth of vulnerable online devices to exploit, the incentive is there for the threat actors to continue the development of BotenaGo.
Click to expand...

AT&T Alien Labs: AT&T Alien Labs finds new Golang malware (BotenaGo) targeting millions of routers and IoT devices with more than 30 exploits

AT&T Alien Labs™ has found new malware written in the open source programming language Golang. Deployed with more than 30 exploits, it has the potential of targeting millions of routers and IoT devices.
Key Takeaways:

BotenaGo has more than 30 different exploit functions to attack a target.

The malware creates a backdoor and waits to either receive a target to attack from a remote operator through port 19412 or from another related module running on the same machine.

It is yet unclear which threat actor is behind the malware and number of infected devices.

Click to expand...

Log in or Sign up

BotenaGo botnet targets millions of IoT devices with 33 exploits

guest Guest

Log in or Sign up

BotenaGo botnet targets millions of IoT devices with 33 exploits

guest Guest

Useful Searches