The FreakOut (aka Necro, N3Cr0m0rPh) Python botnet evolves

guest · Oct 12, 2021

Necro botnet now targets Visual Tools DVRs
October 12, 2021
https://securityaffairs.co/wordpress/123275/cyber-crime/necro-botnet-dvrs.html

Operators behind the FreakOut (aka Necro, N3Cr0m0rPh) Python botnet have added a PoC exploit for Visual Tools DVR, a professional digital video recorder used in surveillance video systems. The POC exploit code for this vulnerability is publicly available since July 2021.

The botnet appeared on the threat landscape in November 2020, the attacks aimed at compromising the target systems to create an IRC botnet, which can later be used to conduct several malicious activities, including DDoS attacks and crypto-mining campaigns.
Click to expand...

At the end of September 2021, researchers at Juniper Threat Labs observed new activity from Necro Python (a.k.a N3Cr0m0rPh , Freakout, Python.IRCBot), it actively exploited some services, including an exploit for Visual Tools DVR VX16 4.2.28.0 from visual-tools.com.

The script can run on both Windows and Linux systems, it leverages polymorphism to bypass signature-based defenses. The botnet uses Domain generation algorithms (DGA) for both its C2 infrastructure and download server.

“We have noted a few changes on this bot from the previous version. First, it removed the SMB scanner which was observed in the May 2021 attack. Second, it changed the url that it injects to script files on the compromised system.” reads the analysis published by the experts
Click to expand...

Unlike previous versions of the Necro bot, the latest one is able to launch DDoS attacks using TOR SOCKS proxies.
Click to expand...

Juniper Threat Labs: Necro Python Botnet Goes After Vulnerable VisualTools DVR

As noted above, this bot added a new exploit to its arsenal. The exploit targets Visual Tools DVR VX16 4.2.28.0. A poc for this exploit was made available to the public in July, 2021.

Aside from the bot, the payload will install a XMRig Monero miner with the following wallet. [...]
Click to expand...

Log in or Sign up

The FreakOut (aka Necro, N3Cr0m0rPh) Python botnet evolves

guest Guest

Log in or Sign up

The FreakOut (aka Necro, N3Cr0m0rPh) Python botnet evolves

guest Guest

Useful Searches