Meet Muhstik – IoT Botnet Infecting Cloud Servers

guest · Nov 11, 2020

Chinese-linked Muhstik botnet targets Oracle WebLogic, Drupal
November 11, 2020
https://www.bleepingcomputer.com/ne...uhstik-botnet-targets-oracle-weblogic-drupal/

Muhstik botnet has been targeting cloud infrastructure and IoTs for years.

The botnet mainly funds itself by mining cryptocurrency using open source tools like XMRig and cgminer.
New details have emerged related to this malware that shed light on its nefarious activities and origins.
Weird attribution and 'anime' references
However, more interesting details emerge when Lacework researchers attempt to trace the botnet's origins. [...]
Click to expand...

By tracking similar correlations, Lacework traced the origin of Muhstik to a Chinese forensics firm.

"These all have links to the same malware upload path belonging to Chinese forensics firm Shen Zhou Wang Yun Information Technology Co., Ltd," explains their blog post.
Additionally, Lacework mentions the original malware samples were uploaded to VirusTotal all at once before Muhstik attacks were observed in the wild.

This indicates, "Shen Zhou Wang Yun is likely the malware originator and not simply the first uploader," suggested Hall.
In the past, researchers have also linked Shen Zhou Wang Yun to the HiddenWasp Linux malware.
Click to expand...

Lacework: Meet Muhstik – IoT Botnet Infecting Cloud Servers

Cloud infrastructure is generally immune to IoT related threats however there are some exceptions – one of these is “Muhstik”.
This blog takes a look at related activity and explores Muhstik’s intrusion infrastructure and possible attribution.

For example in 2015, the “cereal” IoT botnet was also observed downloading Anime videos as part of an alleged hobby project . Also, .anime was a frequent process artifact in IoT malware variants and was targeted by Mirai’s memory scraping module. This is observable in the decoded config for the Muhstik scanner module. For IoTs botnets of Chinese origin, this would make sense due to the massive popularity of Anime in China.
Click to expand...

Log in or Sign up

Meet Muhstik – IoT Botnet Infecting Cloud Servers

guest Guest

Log in or Sign up

Meet Muhstik – IoT Botnet Infecting Cloud Servers

guest Guest

Useful Searches