Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits

Summary: Since March 2023, Unit 42 researchers have observed threat actors exploiting multiple IoT vulnerabilities to spread a Mirai botnet variant, gaining complete control of compromised devices and using them for DDoS attacks. The campaign's shell script downloader, hosted at zvub[.]us, was traced to source IP 185.44.81[.]114, which showed telnet brute force attempts since Oct. 6, 2022, and a second campaign from 193.32.162[.]189 since April 11, 2023 delivered the same downloader.

Bottom line: This Mirai variant carries no built-in telnet/SSH brute forcing or exploit code, so its only spread channel is the operator's manual exploitation of unpatched IoT devices - meaning every device left unpatched is a deliberate target, not collateral.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related