Security researchers warn of a new variant of the Mirai botnet. Attackers used it for zero-day exploits on industrial routers.
According to security analyses, the Gayfemboy botnet, based on the infamous Mirai malware, is currently spreading around the world. Researchers at Chainxin X Lab found that cybercriminals have been using the botnet to attack previously unknown vulnerabilities since November 2024. The botnet’s preferred targets include Four-Faith and Neterbit branded routers or smart home devices.
In this context, experts from VulnCheck reported at the end of December of a vulnerability in Four-Faith industrial routers (CVE-2024-12856) that was exploited in the wild. The attackers exploited the router’s default credentials to start a remote command injection.
In addition, the botnet has been used for targeted attacks on unknown vulnerabilities in Vimar Neterbit routers and smart home devices. According to Chainxin X Lab, Gayfemboy is used for a total of 20 vulnerabilities and weak telnet passwords. It has a brute force module for insecure telnet passwords, uses custom UPX packing with unique signatures, and implements Mirai-based command structures. This allows the attackers to update clients, scan networks and carry out DDoS attacks.
Targets
According to the researchers, the botnet has been attacking hundreds of targets every day since its discovery in February 2024. The number of daily active bot IPs is 15,000, most of which are located in China, the USA, Russia, Turkey and Iran. The targets of attacks are spread all over the world and affect different industries. The main targets are in China, the United States, Germany, the United Kingdom, and Singapore.
According to Chainxin X Lab, while the botnet’s DDoS attacks are short-lived (between 10 and 30 seconds), they have a high intensity, with the data rate exceeding 100 Gbps and can cause disruption even to robust infrastructures.
Devices at risk
According to the analysis, the botnet’s attacks target the following devices:
- ASUS routers (via N-Day exploits).
- Huawei routers (via CVE-2017-17215)
- Neterbit router (custom exploit)
- LB-Link router (via CVE-2023-26801)
- Four-Faith Industrial Routers (via the zero-day now tracked as CVE-2024-12856)
- PZT cameras (via CVE-2024-8956 and CVE-2024-8957 )
- Kguard DVR
- Lilin DVR (via remote code execution exploits)
- Generic DVRs (using exploits such as TVT editBlackAndWhiteList RCE)
- Vimar smart home devices (presumably exploiting an unknown vulnerability)
- Various 5G/LTE devices (likely due to misconfigurations or weak credentials)
