Malware-Botnets nutzen bei jüngsten Angriffen veraltete D-Link-Router aus

Teilen:

Two botnets tracked as ‘Ficora’ and ‘Capsaicin’ have recorded increased activity in targeting D-Link routers that have reached end of life or are running outdated firmware versions.

The list of targets includes popular D-Link devices used by individuals and organizations such as DIR-645, DIR-806, GO-RT-AC750, and DIR-845L.

For initial access, the two pieces of malware use known exploits for CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.

Once a device is compromised, attackers leverage weaknesses in in D-Link’s management interface (HNAP) and execute malicious commands through a GetDeviceSettings action.

The botnets can steal data and execute shell scripts. Attackers appear to compromise the devices for distributed denial-of-service (DDoS) purposes.

Ficora has a widespread geographic distribution with some focus on Japan and the United States. Capsaicin appears to be targeting mostly devices in East Asian countries and increased its activity for just two days, starting on October 21.

Ficora botnet

Ficora is a newer variant of the Mirai botnet, adapted to exploit flaws in D-Link devices specifically.

According to Fortinet’s telemetry data, the botnet shows random targeting, with two notable surges in its activity during October and November.

After gaining initial access on D-Link devices, Ficora uses a shell script named ‘multi’ to download and execute its payload through multiple methods like wgetcurlftpgetund tftp.

The malware includes a built-in brute force component with hard-coded credentials to infect additional Linux-based devices, while it supports multiple hardware architectures.

Regarding its DDoS capabilities, it supports UDP flooding, TCP flooding, and DNS amplification to maximize the power of its attacks.

Capsaicin botnet

Capsaicin is a variant of the Kaiten botnet and is believed to be malware developed by the Keksec group, known for ‘EnemyBot’ and other malware families targeting Linux devices.

Fortinet only observed it in a burst of attacks between October 21 and 22, targeting primarily East Asian countries.

The infection occurs through a downloader script (“bins.sh”), which fetches binaries with the prefix ‘yakuza’ for different architectures, including arm, mips, sparc, and x86.

The malware actively looks for other botnet payloads that are active on the same host, and disable them.

Apart from its DDoS capabilities, which mirror those of Ficora, Capsaicin can also gather host information and exfiltrate it to the command and control (C2) server for tracking.

Defending against botnets

One way to prevent botnet malware infections on routers and IoT devices is to ensure that they’re running the latest firmware version, which should addresses known vulnerabilities.

If the device has reached end-of-life and no longer receives security updates, it should be replaced with a new model.

A a general advice, you should replace default admin credentials with unique and strong passwords and disable remote access interfaces if not needed.

Quelle

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
9:16 am, Feb. 11, 2025
Wetter-Symbol 3°C
L: 3° | H: 4°
haze
Luftfeuchtigkeit: 93 %
Druck: 1018 mb
Wind: 6 mph WNW
Windböe: 0 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 100%
Regen Chance: 0%
Sichtbarkeit: 5 km
Sonnenaufgang: 7:21 am
Sonnenuntergang: 5:07 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 9:00 pm
Wetter-Symbol
3° | 4°°C 0 mm 0% 4 mph 95 % 1018 mb 0 mm/h
Tomorrow 9:00 pm
Wetter-Symbol
2° | 7°°C 0 mm 0% 5 mph 96 % 1021 mb 0 mm/h
Do. Feb. 13 9:00 pm
Wetter-Symbol
3° | 7°°C 0 mm 0% 9 mph 77 % 1025 mb 0 mm/h
Fr. Feb. 14 9:00 pm
Wetter-Symbol
2° | 6°°C 0 mm 0% 8 mph 78 % 1026 mb 0 mm/h
Sa. Feb. 15 9:00 pm
Wetter-Symbol
1° | 5°°C 0 mm 0% 9 mph 75 % 1026 mb 0 mm/h
Today 12:00 pm
Wetter-Symbol
3° | 3°°C 0 mm 0% 4 mph 95 % 1018 mb 0 mm/h
Today 3:00 pm
Wetter-Symbol
4° | 4°°C 0 mm 0% 4 mph 88 % 1017 mb 0 mm/h
Today 6:00 pm
Wetter-Symbol
4° | 4°°C 0 mm 0% 3 mph 86 % 1018 mb 0 mm/h
Today 9:00 pm
Wetter-Symbol
4° | 4°°C 0 mm 0% 3 mph 84 % 1018 mb 0 mm/h
Tomorrow 12:00 am
Wetter-Symbol
4° | 4°°C 0 mm 0% 2 mph 88 % 1019 mb 0 mm/h
Tomorrow 3:00 am
Wetter-Symbol
3° | 3°°C 0 mm 0% 3 mph 92 % 1018 mb 0 mm/h
Tomorrow 6:00 am
Wetter-Symbol
2° | 2°°C 0 mm 0% 3 mph 96 % 1018 mb 0 mm/h
Tomorrow 9:00 am
Wetter-Symbol
3° | 3°°C 0 mm 0% 3 mph 91 % 1019 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€95,359.89
0.56%
Ethereum(ETH)
€2,631.41
2.62%
XRP(XRP)
€2.43
2.42%
Fesseln(USDT)
€0.97
0.00%
Solana(SOL)
€198.70
-0.04%
USDC(USDC)
€0.97
-0.01%
Dogecoin(DOGE)
€0.259136
5.64%
Shiba Inu(SHIB)
€0.000016
2.39%
Pepe(PEPE)
€0.000010
8.45%
Nach oben scrollen