Androxgh0st Botnet: Incorporates Mozi payloads to target IoT devices

Security researchers have observed some developments in the activity of the Androxgh0st botnet, which include, among other things, the incorporation of payloads from the Mozi botnet.

CloudSEK 's Threat Research team reports that Androxgh0st, active since January 2024, has begun targeting web servers, using vulnerabilities to infiltrate systems . The botnet is also deploying Mozi payloads , which target Internet of Things (IoT) devices . The integration of elements of the Mozi botnet raises concerns about a possible alliance between the two botnets.

See also: Chinese hackers use Quad7 botnet to steal credentials

Use of vulnerabilities

According to CloudSEK research, the Androxgh0st botnet exploits several vulnerabilities in technologies such as Cisco ASA, Atlassian JIRA, and multiple PHP frameworks. The vulnerabilities provide unauthorized access and facilitate remote code execution on compromised systems.

Some of the vulnerabilities used by the Androxgh0st botnet are:

• CVE -2017-9841 in PHPUnit that allows backdoor access to websites
• CVE -2018-15133 in Laravel that allows execution of encrypted code
• CVE -2021-41773 , which allows path traversal attacks

New analysis by CloudSEK has revealed that the Androxgh0st botnet is now targeting IoT devices, with Mozi payloads, which previously targeted routers and DVRs across China, India, and Albania, before its creators were arrested in 2021.

See also: Mirai-inspired Gorilla Botnet hits 0.3 million targets in 100 countries

Despite the Mozi outage, recent Androxgh0st command and control logs suggest that its payloads have been integrated into Androxgh0st's infrastructure, creating a more widespread infection network and increasing the threat to IoT environments.

Protection against botnet

To protect yourself from Botnets, it is important to keep software and operating system up to date. Botnet attacks often exploit known vulnerabilities.

Additionally, it is important to use a reliable security program that provides protection against malware and botnets. This should include performing regular scans to detect and remove any attacks.

See also: US says Chinese Botnet compromises 260,000 SOHO devices

Using strong passwords and changing them regularly is another way to protect yourself from Botnets (e.g. Androxgh0st). Botnet attacks often try to guess passwords, so using strong passwords and changing them regularly can help protect accounts .

Finally, information security training can be particularly useful. Understanding how botnet attacks work and the techniques they use can help you identify and avoid attacks.

Source: www.infosecurity-magazine.com