Inside the Hoaxcalls Botnet: Both Success and Failure

mood · May 28, 2020

Inside the Hoaxcalls Botnet: Both Success and Failure
The DDoS group sets itself apart by using exploits — but it doesn’t always pan out
May 28, 2020
https://threatpost.com/inside-hoaxcalls-botnet-success-failure/156107/

The Hoaxcalls botnet, built to carry out large-scale distributed denial-of-service (DDoS) attacks, has been actively in development since the beginning of the year. One of its hallmarks is that it uses different vulnerability exploits for initial compromise.

Researchers, however, have discovered that it’s been a hit-or-miss journey for its operators when it comes to the bugs they choose – while at the same time, they’ve had to reboot after takedowns.

“The Hoaxcalls campaign has provided researchers with a number of opportunities over the last several months to explore the trials and errors in researching, developing and building a botnet campaign and the abandoned infrastructure that are left behind,” explained Daniel Smith, researcher with Radware, in a Thursday posting.
Click to expand...

Hoaxcalls Failures
Some of the exploits that the Hoaxcalls group tried but abandoned include the bugs tracked as CVE-2018-10562 and CVE-2018-10561, which are authentication-bypass and command-injection bugs for GPON home routers. Smith’s analysis showed that the cyberattackers used it only a handful of times over the last 90 days.

“The group likely abandoned this exploit for propagation because of its popularity with other, competing bot herders,” explained Smith.
In general, exploits do not guarantee additional devices.
“They can fail for one reason of another,” Smith said. “Some of these reasons include the threat actor’s inability to properly leverage an exploit, a limited number of devices to target or oversaturation due to competition.”
Click to expand...

Overall, “while the threat actors have had a good run so far, developing many variants and leveraging numerous exploits, they have experienced some degree of failure,” Smith said. “Chalk it up to trial and error.”
Click to expand...

Radware: Ghosting Bots: The Story of Hoaxcalls Failures

Log in or Sign up

Inside the Hoaxcalls Botnet: Both Success and Failure

mood Updates Team

Log in or Sign up

Inside the Hoaxcalls Botnet: Both Success and Failure

mood Updates Team

Useful Searches