New Mirai variant adds stealth capabilities to notorious botnet code
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
FortiGuard Labs has identified Evooo1Bot, a previously undocumented Linux malware based on the Mirai botnet code, which has been actively exploiting unpatched vulnerabilities in internet-facing hardware for at least a month. Targeted devices include routers and edge hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, with telemetry showing activity in North and South America, Europe, India, China and Japan. Beyond Mirai's usual DDoS functions, the variant adds encrypted C2 communications, a honeypot-aware SSH scanner, a sniffer for unchanged default credentials, and abuse of the SOCKS protocol to turn compromised devices into persistent proxies for concealing origin and pivoting into internal networks.
- Actively exploits unpatched Alcatel, D-Link, Netgear, Tenda and other devices
- Encrypted C2 and honeypot detection exceed the baseline of Mirai derivatives
- SOCKS proxy abuse hides attacker origin and enables internal network pivoting
- Sniffer harvests devices still using factory default credentials
- Mirai descendants Aisuru and KimWolf were targeted by law enforcement in March
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078.001 Default AccountsT1573 Encrypted ChannelT1090 ProxyT1498 Network Denial of Service
- Products
- FortiGuard Labs
- Organizations
- FortiGuard Labs
From the original article
2 min read at therecord.media
Malware that adds multiple capabilities to the infamous Mirai botnet code has been actively exploiting vulnerabilities in internet-facing hardware for at least a month, researchers said Thursday. Dubbed Evooo1Bot, the Linux-based malware targets routers and other hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, according to researchers at FortiGuard Labs.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.