New BotenaGo Botnet Uses 33 Exploits against IoT Devices

AT&T experts have discovered a new botnet BotenaGo. The malware uses more than thirty exploits to attack routers and other Internet of Things devices.

As the name implies, the botnet is written in the Golang (Go) language, which has become increasingly popular among malware developers in recent years. Only 6 سے باہر 62 antivirus products on VirusTotal identify BotenaGo as malware (with some identifying it as a Mirai variation).

VirusTotal Report

The researchers say that BotenaGo uses 33 exploits for various routers, modems and NAS devices. Among them there are exploits for the following problems:

  1. CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers;
  2. CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices;
  3. CVE-2019-19824: Realtek SDK based routers;
  4. CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS;
  5. CVE-2020-10987: Tenda Products;
  6. CVE-2014-2321: ZTE Modems;
  7. CVE-2020-8958: 1GE ONU.

Due to so many exploits, malware is capable of attacking millions of devices. مثال کے طور پر, experts write that, according to Shodan, the vulnerable open-source Boa web server alone, whose support has already been discontinued, is still used by more than two million devices.

Shodan Report

دی AT&T report states that the malware uses different links to receive payloads, depending on the device being attacked. بدقسمتی سے, during the study of the malware, there were no payloads on the server at all, so it was not possible to study them.

اس کے علاوہ, the researchers write that they have not yet found active communications between BotenaGo and the server controlled by the attackers. They give three possible explanations for this:

  1. BotenaGo is only a part (module) of a multi-stage modular attack, and it is not at all responsible for communicating with the C&C server.
  2. BotenaGo is a new tool used by Mirai operators on certain machines. This theory is supported by general references for payloads.
  3. Malware is not ready for work yet, and the sample accidentally got into the network.

Let me remind you that I also wrote that Pink botnet is infected over 1.5 million devices, as well as that MyKings botnet steals cryptocurrency via clipboard.

ہیلگا اسمتھ

مجھے ہمیشہ کمپیوٹر سائنسز میں دلچسپی تھی۔, خاص طور پر ڈیٹا سیکیورٹی اور تھیم, جسے آج کل کہا جاتا ہے۔ "ڈیٹا سائنس", میری ابتدائی نوعمری سے. ایڈیٹر ان چیف کے طور پر وائرس ہٹانے والی ٹیم میں آنے سے پہلے, میں نے کئی کمپنیوں میں سائبر سیکیورٹی کے ماہر کے طور پر کام کیا۔, ایمیزون کے ٹھیکیداروں میں سے ایک سمیت. ایک اور تجربہ: مجھے آرڈن اور ریڈنگ یونیورسٹیوں میں پڑھانا ملا ہے۔.

جواب چھوڑیں

یہ سائٹ سپیم کو کم کرنے کے لیے Akismet کا استعمال کرتی ہے۔. جانیں کہ آپ کے تبصرے کے ڈیٹا پر کیسے کارروائی کی جاتی ہے۔.

واپس اوپر کے بٹن پر