• Search for:
    11Oct, 2023
    IZ1H9 Botnet Targets IoT Devices With New Exploits

    FortiGuard Labs, the research arm of security firm Fortinet, has uncovered a significant evolution in the IZ1H9 Mirai-based DDoS campaign. 

    Discovered in September and described in an advisory published on Monday, the new campaign has reportedly rapidly updated its arsenal of exploits, incorporating 13 distinct payloads, targeting various vulnerabilities across different Internet of Things (IoT) devices.

    Peak exploitation was recorded on September 6, with trigger counts reaching the tens of thousands. This highlights the campaign’s ability to infect vulnerable devices and expand its botnet swiftly through newly released exploit codes, encompassing multiple CVEs.

    The exploit payloads focus on vulnerabilities in D-Link, Netis, Sunhillo SureLine, Geutebruck, Yealink Device Management, Zyxel, TP-Link Archer, Korenix JetWave and TOTOLINK devices. Each payload is tailored to exploit specific vulnerabilities, ranging from command injection to remote code execution (RCE).

    The injected payload initiates a shell script downloader, “l.sh,” from a specific URL. It proceeds to delete logs, download and execute various bot clients for Linux architectures and obstruct network connections on multiple ports.

    IZ1H9, a Mirai variant, infects Linux-based IoT devices, rendering them remote-controlled bots for large-scale network attacks. Its configuration is decoded with an XOR key, revealing additional payload downloader URLs, along with pre-set login credentials for brute-force attacks.

    Read more on IZ1H9: New Mirai Variant Campaigns are Targeting IoT Devices

    Command-and-control (C2) communication between compromised devices and the command server is detailed, demonstrating the campaign’s sophistication in launching DDoS attacks with specific parameters.

    Fortinet researcher Cara Lin said the research underscored the persistent threat posed by RCE attacks on IoT devices. 

    “Despite the availability of patches for these vulnerabilities, the number of exploit triggers remains alarmingly high, often numbering in the thousands,” she wrote.

    “What amplifies the impact of the IZ1H9 Campaign are the rapid updates to the vulnerabilities it exploits. Once an attacker gains control of a vulnerable device, they can incorporate these newly compromised devices into their botnet, enabling them to launch further attacks like DDoS attacks and brute-force,” Lin added.

    To mitigate this threat, organizations are urged to apply patches promptly and alter default login credentials for their devices.

    Resource : https://www.infosecurity-magazine.com/news/iz1h9-botnet-targets-iot-devices/

    22Mar, 2023
    HinataBot, a new Go-Based DDoS botnet in the threat landscape

    A new Golang-based DDoS botnet, tracked as HinataBot, targets routers and servers by exploiting known vulnerabilities.

    Akamai researchers spotted a new DDoS Golang-based botnet, dubbed HinataBot, which has been observed exploiting known flaws to compromise routers and servers.

    The experts reported that the HinataBot bot was seen being distributed since the beginning of 2023 and its operators are actively updating it.

    The name “Hinata” comes after a character from the popular anime series, Naruto.

    Akamai’s SIRT recently discovered the new bot within HTTP and SSH honeypots, it stood out due to its large size and the lack of specific identification around its newer hashes.

    The sample captured by the experts abuses old vulnerabilities and weak credentials, the researchers reported that it attempts to exploit flaws in the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and exposed Hadoop YARN servers (CVE N/A). 

    HinataBot supports multiple methods of communication, including both dialing out and listening for incoming connections. The botnet can launch distributed denial-of-service (DDoS) flooding attacks that relies on protocols such as HTTP, UDP, TCP, and ICMP to send traffic. However, the latest version of HinataBot only supports HTTP and UDP attacks.

    Akamai said that by reverse engineering the bot and imitating the command and control (C2) server, was able to test the offensive capabilities of the botnet by running two attack methods (HTTP and UDP) in a 10-second period.

    HinataBot botnet

    “The http_flood generated 3.4 MB of packet capture data and pushed 20,430 HTTP requests. The request sizes ranged from 484 to 589 bytes per request, with sizes varying mostly due to randomization of User-Agent and Cookie header data.” reads the report published by Akamai. “The udp_flood generated 6,733 packets for a total of 421 MB of packet capture data over the wire. There isn’t much else that’s interesting about this attack: it is volumetric in nature and seems to do a decent job of pushing volume.”

    Test results show that a botnet composed of just 1,000 nodes can carry out a UDP flood that would weigh in at around 336 Gbps per second. A botnet of 10,000 nodes (which is roughly 6.9% of the size of Mirai at its peak) can generate a UDP flood that would weigh in at more than 3.3 Tbps. The HTTP flood at 1,000 nodes would generate roughly 2.7 Gbps and more than 2 Mrps, while with 10,000 nodes, those numbers jump to 27 Gbps delivering 20.4 Mrps.

    HinataBot is the last bot in order of time to join the ever-growing list of emerging Go-based bots after GoBruteforcer and KmsdBot.

    “The HinataBot family relies on old vulnerabilities and brute forcing weak passwords for distribution. This is yet another example of why strong password and patching policies are more critical than ever.” concludes Akamai that also privided Indicators of Compromise and YARA rules for this threat.

    Resource : https://securityaffairs.com/143618/cyber-crime/hinatabot-go-based-ddos-botnet.html

    22Mar, 2023
    Mirai V3G4 botnet exploits 13 flaws to target IoT devices

    During the second half of 2022, a variant of the Mirai bot, tracked as V3G4, targeted IoT devices by exploiting tens of flaws.

    Palo Alto Networks Unit 42 researchers reported that a Mirai variant called V3G4 was attempting to exploit several flaws to infect IoT devices from July to December 2022. 

    Below is the list of vulnerabilities exploited by V3G4:

    The threat actors’ goal is to infect the largest number of systems as possible to compose a botnet that can be used to conduct multiple attacks, including DDoS attacks.

    The researchers have observed three different Mirai V3G4 campaigns likely operated by the same threat actor for the following reasons:

    • The hardcoded command and control (C2) domains among these three campaigns contain the same string (8xl9)
    • The malware shell script downloaders are almost identical between the three campaigns
    • The botnet client samples use the same XOR decryption key
    • The botnet client samples use the same “stop list” (a list of target processes that the botnet client searches for and terminates)
    • The botnet client samples use almost identical functions

    The botnet exploited 13 vulnerabilities to achieve remote code execution on vulnerable devices. Upon successful exploitation, the malicious code executes wget and curl utilities to download Mirai bot from attackers’ infrastructure and then execute it.

    Mirai V3G4 botnet

    Upon execution, the bot prints xXxSlicexXxxVEGA. to the console. The experts noticed that V3G4 also supports a function that makes sure only one instance of this malware is executing on the compromised device. If a botnet process already exists, the botnet client will and exit.

    The botnet also attempts to terminate a list of processes, included in the hardcoded ‘stop list,’ by checking their names on the infected device.

    Unlike most Mirai variants, the V3G4 variant uses different XOR encryption keys for string encryption.

    The researchers also noticed that the bot samples from the three campaigns have minor differences. The original Mirai botnet sample spreads itself by brute-forcing weak telnet/SSH credentials, while other variants rely brute-force attacks and embedded exploits to spread.

    However, bot samples discovered between September and December 2022 don’t contain the functions of vulnerability exploitation and brute force of credentials.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS.” concludes the report. “Therefore, it is highly recommended that patches and updates are applied when possible.”

    Resource : https://securityaffairs.com/142358/malware/mirai-v3g4-botnet.html