Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Summary: Unit 42 researchers observed a Mirai variant called IZ1H9 spreading through several vulnerabilities against exposed Linux servers and networking devices, with activity detected on April 10, 2023, and earlier Zyxel exploit traffic on Dec. 16, 2022. The malware uses a shell script downloader that deletes logs, pulls architecture-specific bot clients, and blocks SSH, telnet and HTTP ports via iptables rules so victims cannot remotely recover compromised devices.

Key Takeaway: The variant carries nearly 100 pairs of telnet/SSH default credentials for brute-forcing and four remote code execution exploits, so any exposed device with weak logins or an unpatched Tenda G103, LB-Link router, DCN DCBI-Netlog-LAB or Zyxel router can be absorbed into a botnet for DDoS attacks.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related