Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New IoT/Linux Malware Targets DVRs, Forms Botnet

Summary: Unit 42 researchers identified a new variant of the IoT/Linux botnet Tsunami, which they call Amnesia, targeting an unpatched remote code execution vulnerability publicly disclosed in March 2016 in DVR devices made by TVT Digital and branded by over 70 vendors worldwide. Scan data shows the vulnerability affects approximately 227,000 devices globally, with Taiwan, the United States, Israel, Turkey, and India most exposed, and Unit 42 says it has been unable to find any patch from the vendors or manufacturer.

Why it matters: Amnesia is described as the first Linux malware to adopt virtual machine evasion, deleting all files on a system when it detects VirtualBox, VMware, or QEMU - which wipes not only analysis sandboxes but also QEMU-based Linux servers on VPS or public cloud, a catastrophic outcome without backups. The botnet's hard-coded command and control addresses mean blocking them broadly and quickly is the stated path to preventing a Mirai-type DDoS attack.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related