IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
Since March 2023, Unit 42 has tracked threat actors exploiting more than 20 IoT vulnerabilities to spread a Mirai botnet variant, first seen downloading payloads from zvub.us on March 14, 2023. Exploited flaws span CVE-2023-1389 (TP-Link Archer), CVE-2022-30525 (Zyxel), CVE-2022-31499 (Nortek) and many router, camera and DVR bugs. The variant decrypts configuration strings with an XOR key derived from 0xDEADBEEF and lacks built-in credential brute forcing, so spreading relies on manual operator exploitation. Two campaigns observed since October 2022 share infrastructure and near-identical samples.
Key facts
- Campaign exploits 16 listed CVEs plus legacy product exploits across routers, cameras, DVRs and NVRs.
- Shared infrastructure and identical samples link two campaigns since October 2022.
- Variant lacks built-in spreaders, relying on manual vulnerability exploitation.
- Compromised devices give attackers full control for DDoS attacks.
- Payload domains switched from 185.44.81.114 to 185.225.74.251 on March 25, 2023.
- CVEs
- CVE-2019-12725CVE-2019-17621CVE-2019-20500CVE-2021-25296CVE-2021-46422CVE-2022-27002CVE-2022-29303CVE-2022-30023CVE-2022-30525CVE-2022-31499CVE-2022-37061CVE-2022-40005CVE-2022-45699CVE-2023-1389CVE-2023-25280CVE-2023-27240
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.001 Password GuessingT1059.004 Unix ShellT1070.004 File Deletion
- Threat actors
- unnamed Mirai botnet operator
- Malware
- Mirai
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-12725 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability | 9.8 | 90% | PoC | |
| CVE-2019-17621 | Unauthenticated Root Command Injection in D-Link DIR-859 Router UPnP | 9.8 | 91% | KEVPoC ×2 | KEV |
| CVE-2019-20500 | Authenticated OS Command Injection in D-Link DWL-2600AP Access Point Web Interface | 7.8 | 97% | KEVPoC | KEV |
| CVE-2021-25296 | Authenticated OS Command Injection in Nagios XI 5.7.5 Windows WMI Wizard | 8.8 | 72% | KEVPoC ×3 | KEV |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication | 9.8 | 94% | PoC ×2 | |
| CVE-2022-27002 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters | 9.8 | 5% | PoC | |
| CVE-2022-29303 | Unauthenticated Command Injection in Contec SolarView Compact | 9.8 | 98% | KEVPoC ×2 | KEV |
| CVE-2022-30023 | Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function | 8.8 | 39% | PoC | |
| CVE-2022-30525 | OS Command Injection in Zyxel Firewalls Enables Remote Command Execution | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo | 9.8 | 65% | PoC ×2 | |
| CVE-2022-37061 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection | 9.8 | 100% | PoC ×5 | |
| CVE-2022-40005 | Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and… | 8.8 | 35% | PoC ×2 | |
| CVE-2022-45699 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as… | 9.8 | 77% | PoC ×2 | |
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-25280 | Unauthenticated OS Command Injection in D-Link DIR-820 Router (CVE-2023-25280) | 9.8 | 98% | KEVPoC | KEV |
| CVE-2023-27240 | Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip | 9.8 | 3% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | zvub.us | oad a shell script downloader as a file named y from hxxp://zvub[.]us/ . If executed, the shell script downloader would downloa |
| ipv4 | 185.225.74.251 | lients to accommodate different Linux architectures: hxxp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[. |
| ipv4 | 185.44.81.114 | c from our internal threat-hunting system, originating from 185.44.81[.]114 . The threat actor tried to download a shell script downl |
| ipv4 | 193.32.162.189 | 42 researchers also noticed another campaign from source IP 193.32.162[.]189 since April 11, 2023, that delivers the same shell downlo |
| sha256 | 0d404a27c2f511ea7f4adb8aa150f787b2b1ff36c1b67923d6d1c90179033915 | 8d3e65b5ff4dd4067ae30da5f3a96c87ec23ec5be44fc85b543c179b777 0d404a27c2f511ea7f4adb8aa150f787b2b1ff36c1b67923d6d1c90179033915 eca42235a41dbd60615d91d564c91933b9903af2ef3f8356ec4cfff2880 |
| sha256 | 2d0c8ab6c71743af8667c7318a6d8e16c144ace8df59a681a0a7d48affc05599 | 77ae7d359e2ea7fe32db73fa007ee97ee1e9e3c3f0b4163b100b3ec87c2 2d0c8ab6c71743af8667c7318a6d8e16c144ace8df59a681a0a7d48affc05599 4cb8c90d1e1b2d725c2c1366700f11584f5697c9ef50d79e00f7dd2008e |
| sha256 | 366ddbaa36791cdb99cf7104b0914a258f0c373a94f6cf869f946c7799d5e2c6 | 2a2d59d16991a38ea0a112078a6ce42c9e2ee28a74fb2ce7e1edf15dce3 366ddbaa36791cdb99cf7104b0914a258f0c373a94f6cf869f946c7799d5e2c6 413e977ae7d359e2ea7fe32db73fa007ee97ee1e9e3c3f0b4163b100b3e |
| sha256 | 3f427eda4d4e18fb192d585fca1490389a1b5f796f88e7ebf3eceec51018ef4d | 235a41dbd60615d91d564c91933b9903af2ef3f8356ec4cfff2880a2f19 3f427eda4d4e18fb192d585fca1490389a1b5f796f88e7ebf3eceec51018ef4d aaf446e4e7bfc05a33c8d9e5acf56b1c7e95f2d919b98151ff2db327c33 |
| sha256 | 413e977ae7d359e2ea7fe32db73fa007ee97ee1e9e3c3f0b4163b100b3ec87c2 | baa36791cdb99cf7104b0914a258f0c373a94f6cf869f946c7799d5e2c6 413e977ae7d359e2ea7fe32db73fa007ee97ee1e9e3c3f0b4163b100b3ec87c2 2d0c8ab6c71743af8667c7318a6d8e16c144ace8df59a681a0a7d48affc |
| sha256 | 461f59a84ccb4805c4bbd37093df6e8791cdf1151b2746c46678dfe9f89ac79d | 90d1e1b2d725c2c1366700f11584f5697c9ef50d79e00f7dd2008e989a0 461f59a84ccb4805c4bbd37093df6e8791cdf1151b2746c46678dfe9f89ac79d aed078d3e65b5ff4dd4067ae30da5f3a96c87ec23ec5be44fc85b543c17 |
| sha256 | 4cb8c90d1e1b2d725c2c1366700f11584f5697c9ef50d79e00f7dd2008e989a0 | ab6c71743af8667c7318a6d8e16c144ace8df59a681a0a7d48affc05599 4cb8c90d1e1b2d725c2c1366700f11584f5697c9ef50d79e00f7dd2008e989a0 461f59a84ccb4805c4bbd37093df6e8791cdf1151b2746c46678dfe9f89 |
| sha256 | 4f53eb7fbfa5b68cad3a0850b570cbbcb2d4864e62b5bf0492b54bde2bdbe44b | 6e4e7bfc05a33c8d9e5acf56b1c7e95f2d919b98151ff2db327c333f089 4f53eb7fbfa5b68cad3a0850b570cbbcb2d4864e62b5bf0492b54bde2bdbe44b Infrastructure zvub[.]us 185.225.74[.]251 185.44.81[.]114 1 |
| sha256 | 888f4a852642ce70197f77e213456ea2b3cfca4a592b94647827ca45adf2a5b8 | . Indicators of Compromise Shell Script Downloader Samples 888f4a852642ce70197f77e213456ea2b3cfca4a592b94647827ca45adf2a5b8 Mirai Samples b43a8a56c10ba17ddd6fa9a8ce10ab264c6495b82a386 |
| sha256 | aaf446e4e7bfc05a33c8d9e5acf56b1c7e95f2d919b98151ff2db327c333f089 | eda4d4e18fb192d585fca1490389a1b5f796f88e7ebf3eceec51018ef4d aaf446e4e7bfc05a33c8d9e5acf56b1c7e95f2d919b98151ff2db327c333f089 4f53eb7fbfa5b68cad3a0850b570cbbcb2d4864e62b5bf0492b54bde2bd |
| sha256 | aed078d3e65b5ff4dd4067ae30da5f3a96c87ec23ec5be44fc85b543c179b777 | 9a84ccb4805c4bbd37093df6e8791cdf1151b2746c46678dfe9f89ac79d aed078d3e65b5ff4dd4067ae30da5f3a96c87ec23ec5be44fc85b543c179b777 0d404a27c2f511ea7f4adb8aa150f787b2b1ff36c1b67923d6d1c901790 |
| sha256 | b43a8a56c10ba17ddd6fa9a8ce10ab264c6495b82a38620e9d54d66ec8677b0c | f77e213456ea2b3cfca4a592b94647827ca45adf2a5b8 Mirai Samples b43a8a56c10ba17ddd6fa9a8ce10ab264c6495b82a38620e9d54d66ec8677b0c b45142a2d59d16991a38ea0a112078a6ce42c9e2ee28a74fb2ce7e1edf1 |
| sha256 | b45142a2d59d16991a38ea0a112078a6ce42c9e2ee28a74fb2ce7e1edf15dce3 | a56c10ba17ddd6fa9a8ce10ab264c6495b82a38620e9d54d66ec8677b0c b45142a2d59d16991a38ea0a112078a6ce42c9e2ee28a74fb2ce7e1edf15dce3 366ddbaa36791cdb99cf7104b0914a258f0c373a94f6cf869f946c7799d |
| sha256 | eca42235a41dbd60615d91d564c91933b9903af2ef3f8356ec4cfff2880a2f19 | a27c2f511ea7f4adb8aa150f787b2b1ff36c1b67923d6d1c90179033915 eca42235a41dbd60615d91d564c91933b9903af2ef3f8356ec4cfff2880a2f19 3f427eda4d4e18fb192d585fca1490389a1b5f796f88e7ebf3eceec5101 |
| url | http://185.225.74.251/arc | 4 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k hxxp://185.225.74[.]251/spar |
| url | http://185.225.74.251/armv4l | g bot clients to accommodate different Linux architectures: hxxp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/ar |
| url | http://185.225.74.251/armv5l | fferent Linux architectures: hxxp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/ar |
| url | http://185.225.74.251/armv6l | xp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mi |
| url | http://185.225.74.251/armv7l | xp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mips |
| url | http://185.225.74.251/i586 | hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k |
| url | http://185.225.74.251/i686 | hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc |
| url | http://185.225.74.251/m68k | 86 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k hxxp://185.225.74[.]251/sparc After executing the bot cli |
| url | http://185.225.74.251/mips | xp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh |
| url | http://185.225.74.251/mipsel | hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_6 |
| url | http://185.225.74.251/sh4 | hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i6 |
| url | http://185.225.74.251/sparc | 86 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k hxxp://185.225.74[.]251/sparc After executing the bot client, the shell script download |
| url | http://185.225.74.251/x86_64 | hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 |
| url | http://zvub.us/ | o download a shell script downloader as a file named y from hxxp://zvub[.]us/ . If executed, the shell script downloader would download |
From the original article
10 min read at unit42.paloaltonetworks.com
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table: Intelbras WiFiber 120 AC inMesh Command Injection Vulnerability MVPower DVR Shell Unauthenticated Command Execution Vulnerability
By Chao Lei, Zhibin Zhang, Yiheng An, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.