Experts warn of a surge in activity associated FICORA and Kaiten botnets
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router The D-Link DIR-645 wired/wireless router is vulnerable to OS command injection (CWE-77) in its HNAP interface: input supplied to the GetDeviceSettings action is not properly neutralized, so a remote attacker who sends a crafted HTTP request to the router's HNAP endpoint can have arbitrary operating-system commands executed on the device. Successful exploitation gives the attacker control of the router at the system level, enabling reconfiguration or abuse of the device, traffic interception or redirection, and recruitment into IoT botnets, as reflected in recent Moobot/MooBot botnet campaigns. Any site or household still running a DIR-645, especially one whose web/HNAP management interface is reachable from the internet, is affected; the product is end-of-life. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS assigns a 97.1% probability of exploitation within 30 days (100th percentile). CISA's required action reflects the risk: disconnect the impacted product if it is still in use because it has reached end-of-life. Do: Because the DIR-645 is end-of-life, CISA's required action is to disconnect it; replace the device where possible, or at minimum apply the latest available D-Link firmware for the DIR-645 and ensure the management/HNAP interface is not reachable from the internet (block or restrict remote administration on the WAN side). Check the device for signs of botnet infection, such as unexpected outbound traffic or unexpected HNAP POST/SOAP requests, and prioritize this fix given the 97.1% EPSS score and known in-the-wild exploitation. | — | 97% | KEV |
| largetens of thousands of internet-exposed devices (est.; far more DIR-645 units exist behind NAT given the product's broad consumer/SOHO distribution) | |
| CVE-2019-10891 | An issue was discovered in D-Link DIR-806 devices. An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header. NVD description · AI analysis pending | 9.8 | 19% | PoC |
| — | |
| CVE-2022-37056 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, NVD description · AI analysis pending | 9.8 | 10% | PoC |
| — | |
| CVE-2024-33112 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. NVD description · AI analysis pending | 7.5 | 6% | PoC |
| — |
Full article456 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 27, 2024
FortiGuard Labs observed increased activity from two botnets, the Mirai variant “FICORA” and the Kaiten variant “CAPSAICIN”.
FortiGuard Labs researchers observed a surge in activity associated with two botnets, the Mirai variant “FICORA” and the Kaiten variant “CAPSAICIN,” in late 2024. Both botnets target vulnerabilities in D-Link devices, particularly through the HNAP interface, allowing remote command execution. Some of the vulnerabilities exploited by the botnets are CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.
“According to our IPS telemetry, attackers frequently reuse older attacks, which accounts for the continued spread of the “FICORA” and “CAPSAICIN” botnets to victim hosts and infected targets.” reads the report published by Fortinet. “This article looks at their infected traffic and offers insights into these botnets.”
The researchers noticed that the latest “FICORA” campaign targeted many countries worldwide, suggesting it was not employed in targeted attacks.
The “CAPSAICIN” botnet was highly active for only two days, October 21–22, 2024, primarily targeting East Asian countries.
The “FICORA” botnet downloads and executes a shell script called “multi,” which is removed after execution. The script uses various methods like “wget,” “ftpget,” “curl,” and “tftp” to download the malware. It first terminates processes with the same file extension as “FICORA” and then downloads and executes the malware targeting multiple Linux architectures. The malware’s configuration, including its C2 server domain and a unique string, is encrypted using the ChaCha20 algorithm.
The scanner used by the FICORA botnet includes a hard-coded username and password for its brute force attack function.
The malware “FICORA” is a variant of the Mirai malware, it includes DDoS attack capabilities using multiple protocols such as “UDP,” “TCP,” and “DNS.”
The “CAPSAICIN” botnet uses a downloader script (“bins.sh”) with a different IP address (“87.10.220[.]221”) to fetch the bot to target various Linux architectures. The malware kills known botnet processes to ensure it remains the only one running. Then it connects to its C2 server (“192.110.247[.]46”), sending the victim’s OS information and a unique nickname back to the server.
The “CAPSAICIN” malware appears to be a variant of the Keksec group’s botnets, likely developed from version 17.0.0 of their malware, based on hard-coded information found within it.
“Although the weaknesses exploited in this attack had been exposed and patched nearly a decade ago, these attacks have remained continuously active worldwide. FortiGuard Labs discovered that “FICORA” and “CAPSAICIN” spread through this weakness.” concludes the report. “Because of this, it is crucial for every enterprise to regularly update the kernel of their devices and maintain comprehensive monitoring. These steps will help reduce the likelihood of malware being deployed through this vulnerability.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, FICORA botnet)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/172373/uncategorized/surge-ficora-kaiten-botnets.html