New Mirai Variant Targeting Network Security Devices
Summary: Unit 42 researchers documented a Mirai variant that, starting Feb. 16, 2021, exploited five known and three unknown vulnerabilities in network security devices, adding exploits for CVE-2021-27561 and CVE-2021-27562 hours after those details were published and later incorporating CVE-2021-22502 and CVE-2020-26919. On successful exploitation, the attackers use wget to download a shell script that pulls architecture-specific Mirai binaries, a GoLang SSH brute-forcer called nbrute, a credential list in combo.txt, and zmap to scan port 22.
Bottom line: The operators added a working exploit within hours of a vulnerability's publication, and the malware then blocks common SSH, HTTP and telnet ports to make cleanup harder for administrators.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2019-19356CVE-2020-25506CVE-2020-26919CVE-2021-22502CVE-2021-27561CVE-2021-27562
- Related
- CVE-2021-27561: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2019-19356: Netis WF2419 Devices Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021