Mootbot Botnet Targets Fiber Routers with Dual Zero-Days

guest · Apr 20, 2020

Mootbot Botnet Targets Fiber Routers with Dual Zero-Days
April 20, 2020
https://threatpost.com/mootbot-fiber-routers-zero-days/154962/

The Mootbot botnet has been using a pair of zero-day exploits to compromise multiple types of fiber routers. According to researchers, other botnets have attempted to do the same, but have so far failed.

According to researchers at NetLab 360, the operators of the Mootbot botnet in late February started to exploit a zero-day bug found in nine different types of fiber routers used to provide internet access and Wi-Fi to homes and businesses (including the Netlink GPON router).
The flaw is a remote code-execution bug with a public proof-of-concept (PoC) exploit – but for it to be used successfully to compromise a target router, it must be paired with a second vulnerability.

“It is likely most of the vendors are OEM products of the same original vendor,” the firm explained in a recent posting.
Moobot is a new botnet family based on Mirai botnet, which targets internet of things (IoT) devices.
Click to expand...

Though it didn’t release details of the second success factor in the kill chain, NetLab 360 recommended that to protect against the threat, users that have fiber-based internet access routers should check and update their device firmware, and check whether there are default accounts that should be disabled.
Click to expand...

360 NetLab: Multiple fiber routers are being compromised by botnets using 0-day

This is our 3rd IoT 0-day series article, in the past 30 days, we have already blogged about 2 groups targeting DrayTek CPE 0-day here [1], and Fbot botnet targeting Lilin DVR 0-day here [2].

Apparently while most botnets play catchup games, some have deep resources and probably deep pocket to get hold of the public unknown exploits. Our botnet researchers are fascinated by this and will see if this is a new trend.
Click to expand...

Log in or Sign up

Mootbot Botnet Targets Fiber Routers with Dual Zero-Days

guest Guest

Log in or Sign up

Mootbot Botnet Targets Fiber Routers with Dual Zero-Days

guest Guest

Useful Searches