Malware botnets exploit outdated D-Link routers

Two malware botnets tracked as "Ficora" and "Capsaicin" are targeting D-Link routers, which have reached end-of-life or are running outdated firmware versions, with increasing frequency.

See also: Mirai Botnet targets Juniper smart routers

The list of targets includes popular D-Link devices used by individuals and organizations such as the DIR-645, DIR-806, GO-RT-AC750 , and DIR-845L.

For initial access, the two malware segments use known exploits for CVE-2015-2051, CVE-2019-10891, CVE-2022-37056 , and CVE-2024-33112. Once a device is compromised, attackers exploit vulnerabilities in the D-Link management interface (HNAP) and execute malicious commands via a GetDeviceSettings.

Malware botnets can intercept data and execute shell scripts on D-Link devices. The attackers appear to be compromising the devices for distributed denial of service (DDoS) purposes.

Ficora has a broad geographic distribution with some focus on Japan and the United States. Capsaicin appears to primarily target devices in East Asian countries and increased its activity for just two days, starting on October 21.

See also: BADBOX Botnet hacked 74,000 Android devices

Ficora is a newer variant of the Mirai botnet, tailored to exploit specific flaws in D-Link devices.

According to Fortinet telemetry data , the botnet exhibits random targeting, with two notable spikes in its activity in October and November .

After gaining initial access to D-Link devices, Ficora uses a shell script named "multi" to download and execute its payload via multiple methods such as wget, curl, ftpget , and tftp.

The malware includes an embedded brute force component with hardcoded credentials to infect additional Linux- based devices , while supporting multiple hardware architectures.

In terms of DDoS capabilities, it supports UDP flooding, TCP flooding , and DNS amplification to maximize the power of its attacks.

See also: Socks5Systemz Botnet Boosts Illegal Proxy Service

Malware botnets, such as those targeting D-Link routers, pose a significant cybersecurity threat by leveraging networks of compromised devices to perform malicious activities. Defending against botnets requires a multi-layered approach. Implementing strong passwords and regular software updates helps secure devices from flaws exploited by botnets. Additionally, using firewalls and intrusion detection systems can monitor and block unauthorized traffic. Educating users about phishing emails and suspicious links minimizes the risk of initial infection. Organizations should also use network segmentation to limit the spread of potential botnet attacks within their infrastructure. Proactive monitoring and collaboration with cybersecurity communities ensure early detection and mitigation of emerging botnet threats.

Source: bleepingcomputer