New 'Gucci' IoT Botnet Targets Europe

guest · Sep 30, 2019

New 'Gucci' IoT Botnet Targets Europe
September 30, 2019
https://www.securityweek.com/new-gucci-iot-botnet-targets-europe

Called Gucci, the same as the Italian luxury brand of fashion and leather goods, the botnet appears to be new and previously undocumented, security researchers Aditya K Sood and Rohit Bansal told SecurityWeek in an email exchange.

The malware is targeting multiple architectures, including ARM, x86, MIPS, PPC, M68K and others, binaries discovered on the attackers’ server showed. The binaries were being disseminated from a server located in the Netherlands.
While investigating the malware, the researchers discovered that each bot was connecting to a remote IP address on TCP port 5555, and also identified the remote host running a custom telnet service on TCP port 5555.

When attempting to establish a TCP connection to the host, however, the researchers were prompted to provide a username and password for authentication.
Using automation, the researchers were able to crack the required credentials and access the command and control (C&C) panel.
Click to expand...

In fact, as soon as they realized that the C&C had been compromised, the operators removed the aforementioned TCP service from the host and also attempted to hide indicators and artefacts by cleaning the directories and performing other operations.

“The botnet operator was found to be very proactive. The whole analysis and obtaining C&C access was like an arms race,” the security researchers note.
At the moment, the botnet seems to be in its early stages of development and it appears to be targeting the European continent.
Click to expand...

Log in or Sign up

New 'Gucci' IoT Botnet Targets Europe

guest Guest

Log in or Sign up

New 'Gucci' IoT Botnet Targets Europe

guest Guest

Useful Searches