Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns
Summary: Unit 42 reported three malware campaigns built on publicly available Mirai and Gafgyt source code that emerged at the end of May 2018, with samples carrying as many as eleven exploits in a single sample - more than the IoT Reaper malware's nine. One campaign, an evolution of the Omni botnet, added the D-Link DSL-2750B command injection vulnerability only weeks after its Metasploit module was published on May 25, and samples also supported new DDoS methods including TCP Christmas tree packets and a Gafgyt method named SendHTTPCloudflare.
What's compelling: A single sample now bundles eleven known IoT exploits, and one of them was weaponized within weeks of a public Metasploit module appearing - the gap between disclosure and exploitation in this ecosystem is measured in days, not months.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2014-8361CVE-2017-17215CVE-2018-10561CVE-2018-1562
- Related
- IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability Cyber Risks ·Mirai Compiled for New Processors Surfaces in the Wild Cyber Risks ·