A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs

Teilen:

Akamai researchers discovered a new Mirai botnet variant targeting a vulnerability in DigiEver DS-2105 Pro DVRs.

Akamai researchers spotted a Mirai-based botnet that is exploiting an remote code execution vulnerability in DigiEver DS-2105 Pro NVRs.

The experts pointed out that this Mirai variant has been modified to use improved encryption algorithms. The Mirai variant incorporates ChaCha20 and XOR decryption algorithms.

A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs 1

In November 2024, the Akamai Security Intelligence Research Team (SIRT) observed increased activity targeting the URI /cgi-bin/cgi_main.cgi, linked to a Mirai-based malware campaign exploiting an unassigned RCE vulnerability in DVR devices, including DigiEver DS-2105 Pro.

“Further investigation into this campaign revealed a new botnet that calls itself the “Hail Cock Botnet” that’s been active since at least September 2024.” reads the analysis published by Akamai. “Using a Mirai malware variant that incorporates ChaCha20 and XOR decryption algorithms, it has been seen compromising vulnerable Internet of Things (IoT) devices in the wild, such as the DigiEver DVR, and TP-Link devices through CVE-2023-1389.”

Upon exploiting the vulnerability, the malicious code can inject commands via the ntp parameter, allowing attackers to download Mirai-based malware through HTTP POST requests over port 80, referencing “IP Address:80/cfg_system_time.htm” in the HTTP Referer header.

The new Mirai malware variant also targets the TP-Link flaw CVE-2023-1389 and the vulnerability CVE-2018-17532 affecting Teltonika RUT9XX routers.

The malware maintains persistence using a cron job that downloads a shell script from “hailcocks[.]ru.”

The bot uses curl or wget to download the “wget.sh” file, ensuring compatibility if one is unavailable on the host.

The malware connects to various hosts for Telnet/SSH brute-forcing and uses a single IP linked to “kingstonwikkerink[.]dyn” for C2 communication. Compromised hosts display unique strings during execution, including “you are now apart of hail cock botnet” in older versions and “I just wanna look after my cats, man.” in newer ones.

“One of the easiest methods for threat actors to compromise new hosts is to target outdated firmware or retired hardware.” concludes the report. “The DigiEver DS-2105 Pro, which is approximately 10 years old now, is an example. Hardware manufacturers do not always issue patches for retired devices, and the manufacturer itself may sometimes be defunct. Therefore, in circumstances in which security patches are unavailable and unlikely to come, we recommend upgrading vulnerable devices to a newer model.”

Akamai’s report includes indicators of compromise (IoC) associated with these attacks along with Yara rules for the detection of the threat.

Quelle

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
11:09 am, Juli 11, 2025
Wetter-Symbol 28°C
L: 26° | H: 30°
wenige Wolken
Luftfeuchtigkeit: 45 %
Druck: 1021 mb
Wind: 2 mph NNW
Windböe: 3 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 13%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:56 am
Sonnenuntergang: 9:15 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
26° | 30°°C 0 mm 0% 8 mph 47 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
18° | 30°°C 0 mm 0% 9 mph 65 % 1018 mb 0 mm/h
So. Juli 13 10:00 pm
Wetter-Symbol
17° | 27°°C 0 mm 0% 7 mph 73 % 1014 mb 0 mm/h
Mo. Juli 14 10:00 pm
Wetter-Symbol
20° | 29°°C 0 mm 0% 14 mph 71 % 1017 mb 0 mm/h
Di. Juli 15 10:00 pm
Wetter-Symbol
15° | 27°°C 0 mm 0% 13 mph 71 % 1021 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
29° | 29°°C 0 mm 0% 3 mph 42 % 1021 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
30° | 31°°C 0 mm 0% 5 mph 31 % 1019 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
28° | 28°°C 0 mm 0% 5 mph 28 % 1017 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
22° | 22°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
18° | 18°°C 0 mm 0% 4 mph 55 % 1018 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
19° | 19°°C 0 mm 0% 4 mph 65 % 1018 mb 0 mm/h
Tomorrow 7:00 am
Wetter-Symbol
19° | 19°°C 0 mm 0% 6 mph 64 % 1018 mb 0 mm/h
Tomorrow 10:00 am
Wetter-Symbol
24° | 24°°C 0 mm 0% 6 mph 45 % 1017 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€101,255.25
6.68%
Ethereum(ETH)
€2,579.67
8.69%
Fesseln(USDT)
€0.85
0.01%
XRP(XRP)
€2.23
6.97%
Solana(SOL)
€140.91
4.43%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.170131
9.79%
Shiba Inu(SHIB)
€0.000011
7.31%
Pepe(PEPE)
€0.000011
16.09%
Peanut das Eichhörnchen(PNUT)
€0.246894
20.17%
Nach oben scrollen