New Fodcha Botnet Attacks More Than 100 Victims Daily

Qihoo 360 (360 Netlab) experts report the discovery of a new Fodcha botnet that launches DDoS attacks on hundreds of victims every day. According to the company, the threat is growing rapidly and is replenished with new bots, including routers, DRVs and vulnerable servers.

From March 29 to April 10, the Fodcha botnet included more than 62,000 devices. The number of unique IP addresses associated with the malware fluctuates, with experts monitoring around 10,000 Fodcha bots using Chinese IP addresses every day, with most of them using the services of China Unicom (59.9%) और China Telecom (39.4%).

New Fodcha botnet

Based on direct data that we received from the information security community, the number of live bots exceeds 56,000 daily. The dissemination looks pretty massive, with over 10,000 active bots (IPs) registered daily in China alone, as well as over 100 DDoS attack victims daily.the experts write.

Fodcha is known to infect new devices using exploits designed to use vulnerabilities in a number of devices, as well as the Crazyfia brute force tool. The list of devices and services that Fodcha attacks include:

  1. Android: Android ADB Debug Server RCE;
  2. GitLab: CVE-2021-22205;
  3. Realtek Jungle SDK: CVE-2021-35394;
  4. MVPower DVR: unauthenticated execution of shell commands in JAWS Webserver;
  5. LILIN DVR: LILIN DVR RCE;
  6. TOTOLINK Routers: backdoor in TOTOLINK routers;
  7. ZHONE Router: Web RCE in ZHONE routers.

Fodcha operators use the results of Crazyfia scans to gain access to vulnerable devices and then deploy malware payloads on them. Experts write that the botnet can be capable of MIPS, MPSL, ARM, x86 and other architectures.

The botnet is known to have been using folded[.]in as the domain for the command-and-control server since January 2022, and switched to fridgexperts[.]cc in March when the cloud service provider disabled the first domain.

The new C&C server maps to over a dozen IP addresses and is distributed across multiple countries including the US, Korea, Japan, and India, and more cloud providers associated with it, including Amazon, DediPath, DigitalOcean, Linode, and more.the Qihoo 360 report noted.

Let me remind you that we also wrote that U.S. Authorities Disrupt Cyclops Blink Botnet, and that FritzFrog botnet is active again.

हेल्गा स्मिथ

मुझे हमेशा से कंप्यूटर विज्ञान में रुचि थी, विशेष रूप से डेटा सुरक्षा और विषय, जिसे आजकल कहा जाता है "डेटा विज्ञान", मेरी शुरुआती किशोरावस्था से ही. मुख्य संपादक के रूप में वायरस रिमूवल टीम में आने से पहले, मैंने कई कंपनियों में साइबर सुरक्षा विशेषज्ञ के रूप में काम किया, जिसमें अमेज़न का एक ठेकेदार भी शामिल है. एक और अनुभव: मुझे आर्डेन और रीडिंग विश्वविद्यालयों में पढ़ाना है.

उत्तर छोड़ दें

यह साइट स्पैम को कम करने के लिए Akismet का उपयोग करती है. जानें कि आपका टिप्पणी डेटा कैसे संसाधित किया जाता है.

शीर्ष पर वापस जाएँ बटन