A variant of the Mirai botnet is targeting 22 vulnerabilities in an attempt to take control of D-Link, Arris, Zyxel, TP-Link, Tenda, Netgear, and MediaTek devices and use them for distributed denial-of-service (DDoS) attacks.
See also: These are the largest DDoS attacks ever carried out worldwide
See also: The top 5 cybersecurity threats in 2023
Palo Alto Networks Unit 42 researchers detected the malware in two ongoing campaigns that began on March 14 and peaked in April and June.
In their report today, researchers warned that botnet developers continue to add code for exploitable vulnerabilities.
In total, the malware targets 22 known security issues in various connected products, including routers, DVRs, NVRs, WiFi communication dongles, thermal monitoring systems, access control systems, and solar power generation screens.
Below is the full list of vulnerabilities and products targeted by the malware in the latest version identified by Unit 42 researchers:
One of these flaws, CVE-2023-1389, affects the TP-Link Archer A21 (AX1800) WiFi router and was reported by ZDI as being exploited by the Mirai malware in late April. However, it is unclear whether the two refer to the same activity.
See also: Microsoft Teams: Bug allows malware delivery
Details of the attack
The attack begins by exploiting one of the aforementioned flaws, laying the groundwork for executing a shell script from an external resource.
This script will download the botnet client that matches the architecture of the compromised device, covering armv4l, arm5l, arm6l, arm7l, mips, mipsel, sh4, x86_64, i686, i586, arc, m68k, and sparc.
After the bot client is executed, the shell script downloader deletes the client's files to scan for traces of the infection and reduce the likelihood of detection.
Compared to the usual Mirai variants in circulation, this one has direct access to encrypted strings in the .rodata section with a pointer instead of creating a string table to get the settings for the botnet client.
This approach bypasses the initialization of the encrypted string array, giving the malware speed, stealth, and making it less likely to be detected by security tools.
Unit 42 also notes that this Mirai variant does not have the ability to compromise telnet/SSH login credentials, so its distribution relies solely on operators manually exploiting the vulnerabilities.
Reducing the risk of infection is possible by applying the latest firmware update available from the device vendor or manufacturer, changing the default access credentials to something strong and unique, and removing remote accessibility to the admin panel if not needed.
Signs of botnet malware infection on an IoT may include excessive overheating, changes in settings/configurations, frequent disconnections, and an overall drop in performance.
Information source: bleepingcomputer.com
