Echobot Botnet Spreads via 26 Exploits, Targets Oracle, VMware Apps

ZMsiXone · Jun 14, 2019

https://www.bleepingcomputer.com/ne...s-via-26-exploits-targets-oracle-vmware-apps/

A relatively new botnet called Echobot has grown to 26 the number of exploits it uses to propagate. Most of the exploitation code it includes is for unpatched IoT devices, but enterprise apps Oracle WebLogic and VMware SD-Wan are among the targets, too.

Echobot is based on Mirai malware, like hundreds of other botnets that emerged once the source code became publicly available. It was first disclosed (
hxxps://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/ ) earlier this month by researchers at Palo Alto Networks, who found it contained 18 exploits at the time.

IoT devices are the main targets
Larry Cashdollar of Akamai's Security Intelligence Response Team (SIRT) observed a new version of the Echobot botnet, which adds a host of eight new exploits to help it propagate.
...
Click to expand...

guest · Aug 6, 2019

New Echobot Botnet Variant Uses Over 50 Exploits to Propagate
August 6, 2019
https://www.bleepingcomputer.com/ne...t-variant-uses-over-50-exploits-to-propagate/

A new variant of Echobot botnet has been spotted to include over 50 exploits leading to remote code execution (RCE) vulnerabilities in various Internet-of-Things devices.
The latest Echobot variant was found by security researcher Carlos Brendel Alcañiz, and uses 59 different RCE exploits to propagate, according to a tweet he published today.

Just a couple hours ago I received an exploit targeting Asus devices. Nothing interesting so far. The "richard" file is a shitty dropper, but the malware is just a bot that propagates itself using 61 different RCE exploits. I guess Richard is trying hard to get popular ^^ pic.twitter.com/xA1Tn2o3z1
— Carlos Brendel (@carbreal) August 6, 2019
The interesting part is that the author seems to have thrown in exploits without targeting a specific category of products. The code incorporated is available from multiple public exploit repositories.

It should come as no surprise that this botnet includes such a high number of payloads. The malware is one of the hundreds of spin-offs from Mirai botnet, whose code is publicly available, built for distributed denial-of-service attacks. This enables anyone to modify it to their own liking.
Click to expand...

guest · Dec 12, 2019

New Echobot Variant Exploits 77 Remote Code Execution Flaws
December 12, 2019
https://www.bleepingcomputer.com/ne...iant-exploits-77-remote-code-execution-flaws/

The Echobot botnet is still after the low hanging fruit as a new variant has been spotted with an increased number of exploits that target unpatched devices, IoT for the most part.
A variant discovered this summer included more than 50 exploits that allow remote code execution. A security researcher noticed that a new version emerged with even more exploits, 77 of them.
Hoarding RCE exploits
The 77 exploits in the current version are for products ranging from routers, IP cameras, VoIP phones, presentation systems, smart home hubs, software, data analytics platforms, biometric scanners, network-attached storage systems, thermal cameras.
Security researcher Carlos Brendel found the new Echobot variant and says on Twitter today that the exploits are now hosted at 10 different IP addresses, while the original IP has been taken down.

All exploit code is from public sources and Brendel compiled a list with the type of risk they present along with the date it became public, revealing a decade of RCEs or command injection has been covered until now. [...]
Click to expand...

Log in or Sign up

Echobot Botnet Spreads via 26 Exploits, Targets Oracle, VMware Apps

ZMsiXone Registered Member

guest Guest

guest Guest

Log in or Sign up

Echobot Botnet Spreads via 26 Exploits, Targets Oracle, VMware Apps

ZMsiXone Registered Member

guest Guest

guest Guest

Useful Searches