Moobot botnet is back and launched a new wave of attacks

guest · Sep 7, 2022

By Pierluigi Paganini - September 7, 2022

Palo Alto Network’s Unit 42 researchers reported a new wave of attacks launched by the Moobot botnet that target vulnerable D-Link routers.

The Mirai-based Moobot botnet was first documented by Palo Alto Unit 42 researchers in February 2021, in November 2021, it started exploiting a critical command injection flaw (CVE-2021-36260) in the webserver of several Hikvision products.
Click to expand...

Now the MooBot has re-emerged in a new attack wave of attacks that started in August, targeting vulnerable D-Link routers. The botnet is exploiting both old and new exploits, below is list of vulnerabilities exploited:

CVE-2015-2051: D-Link HNAP SOAPAction Header Command Execution Vulnerability

CVE-2018-6530: D-Link SOAP Interface Remote Code Execution Vulnerability

CVE-2022-26258: D-Link Remote Command Execution Vulnerability

CVE-2022-28958: D-Link Remote Command Execution Vulnerability

Click to expand...

“Upon execution, the binary file prints get haxored! to the console, spawns processes with random names and wipes out the executable file.” reads the analysis published by Unit 42. “As a variant, MooBot inherits Mirai’s most significant feature – a data section with embedded default login credentials and botnet configuration – but instead of using Mirai’s encryption key, 0xDEADBEEF, MooBot encrypts its data with 0x22.”
Click to expand...

Palo Alto Networks - Unit42: Mirai Variant MooBot Targeting D-Link Devices

By Chao Lei, Zhibin Zhang, Cecilia Hu and Aveek Das - September 6, 2022
In early August, Unit 42 researchers discovered attacks leveraging several vulnerabilities in devices made by D-Link, a company that specializes in network and connectivity products.

If the devices are compromised, they will be fully controlled by attackers, who could utilize those devices to conduct further attacks such as distributed denial-of-service (DDoS) attacks. The exploit attempts captured by Unit 42 researchers leverage the aforementioned vulnerabilities to spread MooBot, a Mirai variant, which targets exposed networking devices running Linux.
Click to expand...

Log in or Sign up

Moobot botnet is back and launched a new wave of attacks

guest Guest

Log in or Sign up

Moobot botnet is back and launched a new wave of attacks

guest Guest

Useful Searches