Mirai Botnet Variant Exploits 4-Religion Router Vulnerability for DDoS Assaults

Jan 08, 2025 Ravie LakshmananMalware / Danger
A variant of the Mirai botnet has been discovered to be exploiting a newly disclosed flaw affecting 4-Religion business routers since early November 2024 for the aim of engaging in allotted denial-of-service (DDoS) assaults. The botnet infects about 15,000 IP addresses each day, infecting nations in China, Iran, Russia, Turkey, and america. The usage of greater than 20 common safety gear and susceptible Telnet credentials to achieve get admission to for the primary time, the malware is understood to were lively since February 2024. The botnet was once named “gayfemboy” after an offensive word discovered within the supply code. QiAnXin XLab stated it has detected malware this is exploiting a zero-day vulnerability in China’s 4-Religion production amenities to ship artifacts from November 9, 2024.

The vulnerability in query is CVE-2024-12856 (CVSS rating: 7.2), which refers to an running device (OS) injection affecting router fashions F3x24 and F3x36 the usage of default get admission to. Past due final month, VulnCheck instructed The Hacker Information that this vulnerability has been used within the wild to drop backdoor and Mirai-like payloads on compromised units. Probably the most different safety flaws utilized by the botnet to develop and make bigger come with CVE-2013-3307, CVE-2013-7471, CVE-2014-8361, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2017-5259. 2020-25499, CVE-2020-9054, CVE-2021-35394, CVE-2023-26801, CVE-2024-8956, and CVE-2024-8957. As soon as put in, the malware tries to cover malicious processes and use a Mirai-based command line to scan for prone units, adjust itself, and release DDoS assaults towards objectives. DDoS assaults that use botnets goal loads of various organizations each day, with the job attaining a brand new height in October and November 2024. Those assaults, once they final between 10 and 30 seconds, generate visitors of round 100 Gbps. The disclosure comes weeks after Juniper Networks warned that Consultation Good Router (SSR) merchandise with default passwords had been being manipulated by means of malicious actors to deliver down the Mirai botnet malware. Akamai has additionally disclosed a Mirai malware an infection that affects faraway keep watch over in DigiEver DVRs.

“DDoS has grow to be probably the most not unusual and damaging strategies of cyber assault,” XLab researchers stated. “Its assault strategies are numerous, the assault strategies are very refined, and it could use ever-changing strategies and strategies to assault quite a lot of industries and techniques, threatening companies, executive companies, and customers.” The advance additionally comes as attackers are the usage of probably prone and wrong PHP servers (as an example, CVE-2024-4577) to deploy a cryptocurrency miner known as PacketCrypt.

Did you to find this newsletter fascinating? Apply us on Twitter  and LinkedIn to learn extra of our content material.

Author: OpenAI