New Mirai-Based Botnet Exploits Zero-Day Vulnerabilities in Industrial and Smart Devices

A sophisticated Mirai-based botnet is leveraging zero-day exploits and custom vulnerabilities to compromise industrial routers and smart home devices. First observed in February 2024, this botnet has rapidly evolved, exploiting both n-day und zero-day flaws, including a critical vulnerability, CVE-2024-12856, in Four-Faith industrial routers.

Emerging Exploitation Activity

Researchers from Chainxin X Lab reported that exploitation of CVE-2024-12856 began in late December 2024, shortly after its discovery by VulnCheck. This vulnerability, combined with custom exploits for flaws in Neterbit routers und Vimar smart home devices, has expanded the botnet’s infection capabilities.

Botnet Profile

The botnet, whose name contains offensive language, is built on a Mirai-based framework and maintains an average of 15,000 active daily bot nodes across the following countries:

• China
• Vereinigte Staaten
• Russia
• Türkei
• Iran

Key Features:

• Attack Objectives: Primarily used for DDoS attacks targeting hundreds of entities daily. Activity peaked in October and November 2024.
• Propagation Mechanism: Combines public and private exploits for over 20 vulnerabilities to infect diverse devices.
• Brute Force Module: Targets devices with weak Telnet passwords.
• Custom Malware Attributes: Implements Mirai-like commands, uses custom UPX packing, and scans for additional vulnerabilities across networks.

Targeted countries
Source: X Lab

Entdecken Sie Ihr schwächstes Glied. Seien Sie proaktiv, nicht reaktiv. Cyberkriminelle brauchen nur eine Schwachstelle, um zuzuschlagen.

Targeted Devices and Vulnerabilities

The botnet exploits vulnerabilities in a wide range of devices, including:

The botnet actively infects DVRs, routersund smart home devices, further highlighting the vulnerabilities present in internet-exposed systems.

DDoS Attack Characteristics

X Lab’s telemetry revealed that the botnet’s DDoS attacks are:

• Short in Duration: Lasting between 10-30 seconds.
• High in Intensity: Surpassing 100 Gbps of traffic, capable of disrupting even robust infrastructures.
• Global in Reach: Attack targets span China, the US, Deutschland, the UKund Singapur, affecting various industries.

Botnet attack volumes
Source: X Lab

Mitigation Recommendations

To defend against this botnet, users should:

1. Install Updates: Apply the latest firmware updates to patch known vulnerabilities.
2. Replace EOL Devices: Upgrade end-of-life devices to models receiving regular security updates.
3. Secure Configurations:
   • Change default credentials to strong, unique passwords.
   • Disable unnecessary remote access interfaces.
4. Network Monitoring: Use intrusion detection systems to identify anomalous behavior.