New botnet exploits vulnerabilities in cameras and routers

Security researchers are warning of a new campaign that exploits vulnerabilities in AVTECH IP cameras and Huawei HG532 routers to join the devices in the Murdoc Botnet (a variant of the Mirai botnet).

According to Qualys researcher Shilpesh Trivedi , the malicious campaign has been active since at least July 2024, with more than 1,370 systems infected. The majority of infections were detected in Malaysia, Mexico, Thailand, Indonesia, and Vietnam .

See also: MikroTik botnet uses SPF DNS records to spread malware

The Murdoc Botnet appears to exploit known vulnerabilities, such as CVE-2017-17215 and CVE-2024-7029. These allow initial access to Internet of Things (IoT) and download of next-stage payloads via a shell script.

This script retrieves the botnet malware and executes it depending on the CPU architecture. The ultimate goal of the attacks is to arm the botnet to carry out denial-of-service (DDoS) attacks.

See also: New botnet targets industrial routers with zero-day exploits

Botnet protection

To protect against this threat, it is important to software and operating system your device's. Botnet attacks often exploit known vulnerabilities.

It is also essential to use a reliable security program that provides protection against malware and botnets. This should include performing regular scans to detect and remove any attacks.

See also: Malware botnets exploit outdated D-Link routers

Using strong passwords and changing them regularly is another way to protect yourself from Botnets. Botnet attacks often try to guess passwords, so using strong passwords and changing them regularly can help protect your accounts.

Finally, information security training can be particularly useful. Understanding how botnet attacks work can help you identify and avoid attacks.

Source: thehackernews.com