CVE-2014-9727

Mirai V3G4 botnet exploits 13 flaws to target IoT devices

Security Affairs·Feb 16, 21:32 UTC · Feb 16, 2023MalwareCVE-2012-4869CVE-2014-9727CVE-2017-5173+6 CVEs

Honeypots and the Internet of Things

Kaspersky Securelist·Jun 19, 09:08 UTC · Jun 19, 2017VulnerabilityCVE-2014-9727CVE-2013-2678CVE-2014-6271

Mirai Variant V3G4 Targets IoT Devices

Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.

From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.

Palo Alto Unit 42·Aug 17, 13:05 UTC · 29d agoMalware in the wildCVE-2012-4869CVE-2014-9727CVE-2017-5173+6 CVEs