A successor to Mirai? Newly discovered malware aims to create fresh IoT botnet

Dubbed Linux/IRCTelnet, nasty's source code based on Aidra


Miscreants have put together a new strain of malware designed to turn insecure IoT devices into a DDoS attack platform.

The new nasty, Linux/IRCTelnet discovered by security researchers at MalwareMustDie.org, like the infamous Mirai botnet before it relies on default hard-coded credentials to spread across vulnerable devices. The malware is primed for DDoS and IPv6 ready, according to a write-up on MalwareMustDie.org.

"The malware (the bot client) is designed to aim IoT device via telnet protocol, by using its originally coded telnet scanner function, which is brute-forcing the known vulnerable credential of the Linux IoT boxes, via command sent from a CNC malicious IRC server,” the researchers note.

"The botnet is having DoS attack mechanism like UDP flood, TCP flood, along with other attack methods, in both IPv4 and IPv6 protocol, with extra IP spoof option in IPv4 or IPv6 too."

The source code used to build this botnet malware is based on the earlier Aidra botnet, according to MalwareMustDie.org. Hard-coded Italian language messages in the user's communication interface suggest that the author of the retro-fitted malware is an Italian speaker.

Whether Linux/IRCTelnet is effective at spreading much less attacking systems is so far unclear. Even so it's mere arrival is a concern because it points to further trouble ahead.

Security experts are unsurprised that hackers are seeking to emulate the "success" of the Mirai botnet, the malware linked to the attack on DNS provider Dyn that shut down numerous websites on 21 October.

Mike Ahmadi, global director of critical systems security at Synopsys, commented: "It is not at all surprising that a new exploit targeting these devices has been discovered, since many of these devices are built using open source third-party libraries. When we apply software composition analysis tools to many of the most popular third-party software distributions, we often find known vulnerabilities that number in the hundreds, and sometimes in the thousands when looking at the total software build found on IoT devices.

"Unless builders of IoT devices incorporate more rigorous vulnerability detection and management practices into their development process, we can expect more of this malware botnet free for all to occur." ®

Broader topics


Other stories you might like

  • EnemyBot malware adds enterprise flaws to exploit arsenal
    Fast-evolving botnet targets critical VMware, F5 BIG-IP bugs, we're told

    The botnet malware EnemyBot has added exploits to its arsenal, allowing it to infect and spread from enterprise-grade gear.

    What's worse, EnemyBot's core source code, minus its exploits, can be found on GitHub, so any miscreant can use the malware to start crafting their own outbreaks of this software nasty.

    The group behind EnemyBot is Keksec, a collection of experienced developers, also known as Nero and Freakout, that have been around since 2016 and have launched a number of Linux- and Windows-based bots capable of launching distributed denial-of-service (DDoS) attacks and possibly mining cryptocurrency. Securonix first wrote about EnemyBot in March.

    Continue reading
  • Emotet malware gang re-emerges with Chrome-based credit card heistware
    Crimeware groups are re-inventing themselves

    The criminals behind the Emotet botnet – which rose to fame as a banking trojan before evolving into spamming and malware delivery – are now using it to target credit card information stored in the Chrome web browser.

    Once the data – including the user's name, the card's numbers and expiration information – is exfiltrated, the malware will send it to command-and-control (C2) servers that are different than the one that the card stealer module uses, according to researchers with cybersecurity vendor Proofpoint's Threat Insight team.

    The new card information module is the latest illustration of Emotet's Lazarus-like return. It's been more than a year since Europol and law enforcement from countries including the United States, the UK and Ukraine tore down the Emotet actors' infrastructure in January 2021 and – they hoped – put the malware threat to rest.

    Continue reading
  • International operation takes down Russian RSOCKS botnet
    $200 a day buys you 90,000 victims

    A Russian operated botnet known as RSOCKS has been shut down by the US Department of Justice acting with law enforcement partners in Germany, the Netherlands and the UK. It is believed to have compromised millions of computers and other devices around the globe.

    The RSOCKS botnet functioned as an IP proxy service, but instead of offering legitimate IP addresses leased from internet service providers, it was providing criminals with access to the IP addresses of devices that had been compromised by malware, according to a statement from the US Attorney’s Office in the Southern District of California.

    It seems that RSOCKS initially targeted a variety of Internet of Things (IoT) devices, such as industrial control systems, routers, audio/video streaming devices and various internet connected appliances, before expanding into other endpoints such as Android devices and computer systems.

    Continue reading

Biting the hand that feeds IT © 1998–2022