Skip to content
NewA calmer, faster ZeroHour
MalwaremediumExploited in the wild

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Palo Alto Unit 42by Chao Lei, Zhibin Zhang, Cecilia Hu ()7 min read4 · 1 read
Read at unit42.paloaltonetworks.com
AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.

Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.

Key facts
  • IZ1H9 exploits CVE-2023-27076, CVE-2023-26801, CVE-2023-26802 and a Zyxel RCE flaw.
  • Compromised IoT devices join a botnet used for DDoS attacks.
  • Downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.
  • Shared infrastructure and XOR key 0xBAADF00D link campaigns since November 2021.
  • Malware brute-forces embedded default credentials over SSH and Telnet with XOR-encrypted credential tables.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2023-27076CVE-2023-26801CVE-2023-26802
ATT&CK
T1190 Exploit Public-Facing ApplicationT1110.001 Password GuessingT1059.004 Unix ShellT1070.002 Clear Linux or Mac System LogsT1562.001 Impair Defenses: Disable or Modify Tools
Tags
botnetddosiotiz1h9miraitendaunit42zyxel
Vendors
TendaLB-LinkDCNZyxelPalo Alto Networks
Products
Tenda G103LB-LinkDCN DCBI-Netlog-LAB
Threat actors
IZ1H9 threat actor
Malware
MiraiIZ1H9
Organizations
Unit 42

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2023-26801
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection…
9.878%PoC
CVE-2023-26802
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and…
9.849%PoC
CVE-2023-27076
Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter
9.823%PoC

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domaindotheneedfull.cluband those botnet client samples would contact the C2 domain dotheneedfull[.]club . Malware Analysis Based on behavior and patterns Unit 42
domainlolol.shmples that hosted two shell scripts: hxxp://31.210.20[.]100/lolol[.]sh hxxp://212.192.241[.]72/lolol[.]sh The shell script downl
ipv4163.123.143.126ownload and execute a shell script downloader lb.sh from IP 163.123.143[.]126 . If executed, the shell script downloader would first de
ipv4193.47.61.75IZ1H9 variant tries to connect to a hard-coded C2 address: 193.47.61[.]75 , as shown in Figure 4. Figure 4. IZ1H9 malware C2 addres
ipv4195.133.40.141samples would contact a command and control (C2) server at 195.133.40[.]141 where there were URLs in the malware samples that hosted
ipv4212.192.241.72shell script downloaders: hxxp://2.56.59[.]215/i.sh hxxp://212.192.241[.]72/lolol.sh Figure 2 is a diagram illustrating the campaign
ipv4212.192.241.87212.192.241[.]72 would download botnet clients from hxxp://212.192.241[.]87/bins/ , and those botnet client samples would contact the
ipv42.56.59.215ound two URLs hosting more shell script downloaders: hxxp://2.56.59[.]215/i.sh hxxp://212.192.241[.]72/lolol.sh Figure 2 is a diagr
ipv431.210.20.100n the malware samples that hosted two shell scripts: hxxp://31.210.20[.]100/lolol[.]sh hxxp://212.192.241[.]72/lolol[.]sh The shell s
sha25600b151ff78a492b5eae0c8d3c769857f171f8424cf36c3b2505f7d7889109599d722ba3fe97d859bd9b086ff33a14ae9aecfc8a2c3427623f93de3d3b14 00b151ff78a492b5eae0c8d3c769857f171f8424cf36c3b2505f7d7889109599 212b1af9fd1142d86b61956ac1198623f9017153153cfc20bfeab6a9fd4
sha25606ef6c76e481d25aa09b3b15959d702be29c22d63bd35524766397e3d36d0d2ecd29dad935d067a4289445d2efb2710d44d789bf1bf0efb29f94d20e531 06ef6c76e481d25aa09b3b15959d702be29c22d63bd35524766397e3d36d0d2e 7bfb02c563ae266e81ba94a745ea7017f12010d5491708d748296332f26
sha2561e29f364f502b313f01f28f1ae85bf27114fae5eede6550809fe5bca58f591742c563ae266e81ba94a745ea7017f12010d5491708d748296332f26f04f5 1e29f364f502b313f01f28f1ae85bf27114fae5eede6550809fe5bca58f59174 Infrastructure Malware C2 193.47.61[.]75 195.133.40[.]141 d
sha25621185d9b7344edcd8d9c4af174e468c38cb3b061e6bd6bd64a4be9bd3fa27ff5b2effd9fc37ce41ee914fda798de9c9b0e239a0cc94b1464dc2a9984fe9 21185d9b7344edcd8d9c4af174e468c38cb3b061e6bd6bd64a4be9bd3fa27ff5 65a46cd29dad935d067a4289445d2efb2710d44d789bf1bf0efb29f94d2
sha256212b1af9fd1142d86b61956ac1198623f9017153153cfc20bfeab6a9fd44004a1ff78a492b5eae0c8d3c769857f171f8424cf36c3b2505f7d7889109599 212b1af9fd1142d86b61956ac1198623f9017153153cfc20bfeab6a9fd44004a 38406b2effd9fc37ce41ee914fda798de9c9b0e239a0cc94b1464dc2a99
sha25623190d722ba3fe97d859bd9b086ff33a14ae9aecfc8a2c3427623f93de3d3b14e191967ae59c876b4718a087e299bd54f23844 Mirai Variant Sample 23190d722ba3fe97d859bd9b086ff33a14ae9aecfc8a2c3427623f93de3d3b14 00b151ff78a492b5eae0c8d3c769857f171f8424cf36c3b2505f7d78891
sha25638406b2effd9fc37ce41ee914fda798de9c9b0e239a0cc94b1464dc2a9984fe9af9fd1142d86b61956ac1198623f9017153153cfc20bfeab6a9fd44004a 38406b2effd9fc37ce41ee914fda798de9c9b0e239a0cc94b1464dc2a9984fe9 21185d9b7344edcd8d9c4af174e468c38cb3b061e6bd6bd64a4be9bd3fa
sha25664a350a33757f6631dc375632de191967ae59c876b4718a087e299bd54f238440d4f84bda7c0368c915dfd27721d63ed0ce6a9bc9f13e1417d4c2fe88f3 64a350a33757f6631dc375632de191967ae59c876b4718a087e299bd54f23844 Mirai Variant Sample 23190d722ba3fe97d859bd9b086ff33a14ae9a
sha25665a46cd29dad935d067a4289445d2efb2710d44d789bf1bf0efb29f94d20e531d9b7344edcd8d9c4af174e468c38cb3b061e6bd6bd64a4be9bd3fa27ff5 65a46cd29dad935d067a4289445d2efb2710d44d789bf1bf0efb29f94d20e531 06ef6c76e481d25aa09b3b15959d702be29c22d63bd35524766397e3d36
sha256692a5d099e37cd94923ea2b2014d79e6e613fb061a985069736dd3d55d4330c4Indicators of Compromise Artifacts Shell Script Downloader 692a5d099e37cd94923ea2b2014d79e6e613fb061a985069736dd3d55d4330c4 e0b1c324298eeccd54ffc2ff48288ec51fbec44f5f82229537508785a9b
sha2567bfb02c563ae266e81ba94a745ea7017f12010d5491708d748296332f26f04f5c76e481d25aa09b3b15959d702be29c22d63bd35524766397e3d36d0d2e 7bfb02c563ae266e81ba94a745ea7017f12010d5491708d748296332f26f04f5 1e29f364f502b313f01f28f1ae85bf27114fae5eede6550809fe5bca58f
sha256931800d4f84bda7c0368c915dfd27721d63ed0ce6a9bc9f13e1417d4c2fe88f3324298eeccd54ffc2ff48288ec51fbec44f5f82229537508785a9bda6de 931800d4f84bda7c0368c915dfd27721d63ed0ce6a9bc9f13e1417d4c2fe88f3 64a350a33757f6631dc375632de191967ae59c876b4718a087e299bd54f
sha256e0b1c324298eeccd54ffc2ff48288ec51fbec44f5f82229537508785a9bda6ded099e37cd94923ea2b2014d79e6e613fb061a985069736dd3d55d4330c4 e0b1c324298eeccd54ffc2ff48288ec51fbec44f5f82229537508785a9bda6de 931800d4f84bda7c0368c915dfd27721d63ed0ce6a9bc9f13e1417d4c2f
urlhttp://163.123.143.126/bins/dark.86_64.]126/bins/dark.m68k hxxp://163.123.143[.]126/bins/dark.sh4 hxxp://163.123.143[.]126/bins/dark.86_64 In the last step, the shell script downloader would block
urlhttp://163.123.143.126/bins/dark.arm4]126/bins/dark.mips hxxp://163.123.143[.]126/bins/dark.mpsl hxxp://163.123.143[.]126/bins/dark.arm4 hxxp://163.123.143[.]126/bins/dark.arm5 hxxp://163.123.14
urlhttp://163.123.143.126/bins/dark.arm5]126/bins/dark.mpsl hxxp://163.123.143[.]126/bins/dark.arm4 hxxp://163.123.143[.]126/bins/dark.arm5 hxxp://163.123.143[.]126/bins/dark.arm6 hxxp://163.123.14
urlhttp://163.123.143.126/bins/dark.arm6]126/bins/dark.arm4 hxxp://163.123.143[.]126/bins/dark.arm5 hxxp://163.123.143[.]126/bins/dark.arm6 hxxp://163.123.143[.]126/bins/dark.arm7 hxxp://163.123.14
urlhttp://163.123.143.126/bins/dark.arm7]126/bins/dark.arm5 hxxp://163.123.143[.]126/bins/dark.arm6 hxxp://163.123.143[.]126/bins/dark.arm7 hxxp://163.123.143[.]126/bins/dark.ppc hxxp://163.123.143
urlhttp://163.123.143.126/bins/dark.m68k.]126/bins/dark.arm7 hxxp://163.123.143[.]126/bins/dark.ppc hxxp://163.123.143[.]126/bins/dark.m68k hxxp://163.123.143[.]126/bins/dark.sh4 hxxp://163.123.143
urlhttp://163.123.143.126/bins/dark.mipsLinux architectures: hxxp://163.123.143[.]126/bins/dark.x86 hxxp://163.123.143[.]126/bins/dark.mips hxxp://163.123.143[.]126/bins/dark.mpsl hxxp://163.123.14
urlhttp://163.123.143.126/bins/dark.mpsl.]126/bins/dark.x86 hxxp://163.123.143[.]126/bins/dark.mips hxxp://163.123.143[.]126/bins/dark.mpsl hxxp://163.123.143[.]126/bins/dark.arm4 hxxp://163.123.14
urlhttp://163.123.143.126/bins/dark.ppc]126/bins/dark.arm6 hxxp://163.123.143[.]126/bins/dark.arm7 hxxp://163.123.143[.]126/bins/dark.ppc hxxp://163.123.143[.]126/bins/dark.m68k hxxp://163.123.14
urlhttp://163.123.143.126/bins/dark.sh4.]126/bins/dark.ppc hxxp://163.123.143[.]126/bins/dark.m68k hxxp://163.123.143[.]126/bins/dark.sh4 hxxp://163.123.143[.]126/bins/dark.86_64 In the last step
urlhttp://163.123.143.126/bins/dark.x86and executed, to accommodate different Linux architectures: hxxp://163.123.143[.]126/bins/dark.x86 hxxp://163.123.143[.]126/bins/dark.mips hxxp://163.123.14
urlhttp://212.192.241.72/lolol.shng more shell script downloaders: hxxp://2.56.59[.]215/i.sh hxxp://212.192.241[.]72/lolol.sh Figure 2 is a diagram illustrating the campaign overview.
urlhttp://212.192.241.87/bins/er from 212.192.241[.]72 would download botnet clients from hxxp://212.192.241[.]87/bins/ , and those botnet client samples would contact the C2 do
urlhttp://2.56.59.215/bins/oader from 2.56.59[.]215 would download botnet clients from hxxp://2.56.59[.]215/bins/ . Those botnet client samples would contact a command and
urlhttp://2.56.59.215/i.shs and found two URLs hosting more shell script downloaders: hxxp://2.56.59[.]215/i.sh hxxp://212.192.241[.]72/lolol.sh Figure 2 is a diagram il
urlhttp://31.210.20.100/lolol.shURLs in the malware samples that hosted two shell scripts: hxxp://31.210.20[.]100/lolol[.]sh hxxp://212.192.241[.]72/lolol[.]sh The shell script dow

From the original article

7 min read at unit42.paloaltonetworks.com

On April 10, Unit 42 researchers observed a Mirai variant called IZ1H9, which used several vulnerabilities to spread itself. The threat actors use the following vulnerabilities to target exposed servers and networking devices running Linux: CVE-2023-26802 : DCN DCBI-Netlog-LAB remote code execution vulnerability Compromised devices can be fully controlled by attackers and become a part of the botnet.

Palo Alto Unit 42

By Chao Lei, Zhibin Zhang, Cecilia Hu · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.