Russian security firm sinkholes part of the dangerous Meris (Mēris) DDoS botnet

guest · Sep 21, 2021

Russian security firm sinkholes part of the dangerous Meris DDoS botnet
September 21, 2021
https://therecord.media/russian-security-firm-sinkholes-part-of-the-dangerous-meris-ddos-botnet/

Rostelecom-Solar, the cybersecurity division of Russian telecom giant Rostelecom, said on Monday that it sinkholed a part of the Meris DDoS botnet after identifying a mistake from the malware’s creators.

First spotted earlier this year, the Meris botnet is currently the largest DDoS botnet on the internet, with an estimated size of around 250,000 infected systems.
For the past few months, the botnet has been abused by a threat actor that has engaged in DDoS extortion attacks against internet service providers and financial entities across several countries, such as Russia, the UK, the US, and New Zealand.
Click to expand...

Internet infrastructure firms like Cloudflare and Qrator Labs have analyzed the botnet following attacks on their customers and found that the vast majority of infected systems have been MikroTik networking equipment like routers, switches, and access points.

In a blog post last week, MikroTik said the attackers abused an old vulnerability (CVE-2018-14847) in its RouterOS to assemble their botnet using devices that haven’t been updated by their owners.
Click to expand...

Meris botnet operators make a mistake
But in research published on Monday, Rostelecom-Solar said that during routine analysis of this new threat, which has also been attacking some of its customers, its engineers found that some infected routers were reaching out and asking for new instructions from an unregistered domain at cosmosentry[.]com.

Seizing the operator’s mistake, Rostelecom-Solar engineers said they registered this domain and converted it into a “sinkhole.”
In case MikroTik router owners detect these suspicious connections to the cosmosentry[.]com, Rostelecom-Solar said they’ve set up a placeholder message informing them of who owns the domain and why their router is making the connection.
Click to expand...

The Glupteba connection
Per the Rostelecom-Solar team, the Meris botnet appears to have been assembled via Glupteba, a malware strain targeting Windows computers, typically used as a loader for various other malware strains.

However, it is currently unclear if the Glupteba gang built the Meris botnet themselves or if another group rented access to Glupteba-infected hosts to deploy the MikroTik module that eventually led to Meris’ creation.
Click to expand...

Log in or Sign up

Russian security firm sinkholes part of the dangerous Meris (Mēris) DDoS botnet

guest Guest

Log in or Sign up

Russian security firm sinkholes part of the dangerous Meris (Mēris) DDoS botnet

guest Guest

Useful Searches