Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.
Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.
Key facts
- Brute-forces default Tomato credentials admin:admin and root:admin
- About 4,600 Tomato routers exposed on the Internet per Shodan
- Exploits WebLogic deserialization CVE-2019-2725 for unauthenticated RCE
- Kills strace and tcpdump processes as anti-analysis
- Muhstik active since 2018, uses IRC C2 for mining and DDoS
- CVEs
- CVE-2019-2725
- ATT&CK
- T1110.001 Password GuessingT1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1496 Resource Hijacking
- Threat actors
- Muhstik
- Malware
- Muhstik botnet
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fd6fq54s6df541q23sdxfg.eu | mmand is used to download a binary called nvr from http://y.fd6fq54s6df541q23sdxfg[.]eu/nvr 1 2 3 4 / bin / sh - c nvram set rc_firewall = "sleep |
| domain | mods.net | .156[.]190/.y/pty5 hxxp://159.89.156[.]190/.y/pty6 s.shadow.mods[.]net Samples Filename SHA256 File type tty0 492780a9ac9f033055 |
| ipv4 | 132.223.202.213 | like Gecko ) Chrome / 51.0.2704.103 Safari / 537.36 Host : 132.223.202.213 Scan #3: CVE-2019-2725 - WebLogic versions 10.3.6.0 and 12. |
| ipv4 | 159.89.156.190 | s and URLs: hxxp://y.fd6fq54s6df541q23sdxfg[.]eu/nvr hxxp://159.89.156[.]190/.y/pty1 hxxp://159.89.156[.]190/.y/pty3 hxxp://159.89.156 |
| ipv4 | 165.227.78.159 | dy > < / soapenv : Envelope > We think that this URL hxxp://165.227.78[.]159/wl.php is used for the reporting purpose. Because, the sa |
| ipv4 | 185.61.149.22 | e. Appendix C2 IRC servers: 46.149.233[.]35 68.66.253[.]100 185.61.149[.]22 Domains and URLs: hxxp://y.fd6fq54s6df541q23sdxfg[.]eu/nv |
| ipv4 | 194.187.209.4 | like Gecko ) Chrome / 51.0.2704.103 Safari / 537.36 Host : 194.187.209.4 Content - Type : text / xml content - length : 916 < soapen |
| ipv4 | 46.149.233.35 | tifies and blocks Muhstik malware. Appendix C2 IRC servers: 46.149.233[.]35 68.66.253[.]100 185.61.149[.]22 Domains and URLs: hxxp:// |
| ipv4 | 68.66.253.100 | s Muhstik malware. Appendix C2 IRC servers: 46.149.233[.]35 68.66.253[.]100 185.61.149[.]22 Domains and URLs: hxxp://y.fd6fq54s6df541 |
| sha256 | 2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d212232beb1cecd9c31 | 38b360d8a836c038da4920e8c1ae620988b120613c0b1f MIPS-ELF nvr 2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d212232beb1cecd9c31 Shell script Pty1 a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48f |
| sha256 | 492780a9ac9f03305538b360d8a836c038da4920e8c1ae620988b120613c0b1f | s.shadow.mods[.]net Samples Filename SHA256 File type tty0 492780a9ac9f03305538b360d8a836c038da4920e8c1ae620988b120613c0b1f MIPS-ELF nvr 2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d |
| sha256 | 72123c51bcdf8c1784654d9e2470e69131872407408aa3cf775ea0ace87bb9a0 | c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435 MIPS-ELF Pty5 72123c51bcdf8c1784654d9e2470e69131872407408aa3cf775ea0ace87bb9a0 ARM-ELF Pty6 cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6 |
| sha256 | 7325742dc0d939542d4c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435 | abe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687 MIPS-ELF Pty3 7325742dc0d939542d4c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435 MIPS-ELF Pty5 72123c51bcdf8c1784654d9e2470e69131872407408aa |
| sha256 | a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687 | c7b3416ccdd066b73644d4d212232beb1cecd9c31 Shell script Pty1 a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687 MIPS-ELF Pty3 7325742dc0d939542d4c04ae2ae8f2792711203de50d3 |
| sha256 | cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c | 654d9e2470e69131872407408aa3cf775ea0ace87bb9a0 ARM-ELF Pty6 cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c ARM-ELF daymon dc52a1193ecf6096192f771ae663de6e0389840cb5ce |
| sha256 | dc52a1193ecf6096192f771ae663de6e0389840cb5ceb7b979091333ce6f7f02 | f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c ARM-ELF daymon dc52a1193ecf6096192f771ae663de6e0389840cb5ceb7b979091333ce6f7f02 ARM-ELF |
| url | http://159.89.156.190/.y/pty1 | Domains and URLs: hxxp://y.fd6fq54s6df541q23sdxfg[.]eu/nvr hxxp://159.89.156[.]190/.y/pty1 hxxp://159.89.156[.]190/.y/pty3 hxxp://159.89.156[.]190/. |
| url | http://159.89.156.190/.y/pty3 | q54s6df541q23sdxfg[.]eu/nvr hxxp://159.89.156[.]190/.y/pty1 hxxp://159.89.156[.]190/.y/pty3 hxxp://159.89.156[.]190/.y/pty5 hxxp://159.89.156[.]190/. |
| url | http://159.89.156.190/.y/pty5 | ://159.89.156[.]190/.y/pty1 hxxp://159.89.156[.]190/.y/pty3 hxxp://159.89.156[.]190/.y/pty5 hxxp://159.89.156[.]190/.y/pty6 s.shadow.mods[.]net Sampl |
| url | http://159.89.156.190/.y/pty6 | ://159.89.156[.]190/.y/pty3 hxxp://159.89.156[.]190/.y/pty5 hxxp://159.89.156[.]190/.y/pty6 s.shadow.mods[.]net Samples Filename SHA256 File type tty |
| url | http://165.227.78.159/wl.php | nv : Body > < / soapenv : Envelope > We think that this URL hxxp://165.227.78[.]159/wl.php is used for the reporting purpose. Because, the same IP a |
| url | http://y.fd6fq54s6df541q23sdxfg.eu/nvr | .233[.]35 68.66.253[.]100 185.61.149[.]22 Domains and URLs: hxxp://y.fd6fq54s6df541q23sdxfg[.]eu/nvr hxxp://159.89.156[.]190/.y/pty1 hxxp://159.89.156[.]190/. |
From the original article
7 min read at unit42.paloaltonetworks.com
On Dec. 5, 2019, Unit 42 researchers discovered a new variant of the Muhstik botnet that adds a scanner to now attack Tomato routers for the first time by web authentication brute forcing. Tomato is an open source alternative firmware for routers.
By Asher Davila, Cong Zheng, Yang Ji · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.