Updated Mirai Botnet Targets Vulnerable Devices in Ongoing Attacks

Title: New Mirai-based Botnet Targets Vulnerable Routers and Devices: What You Need to Know

Introduction

Recent reports highlight a concerning trend in cyber threats as a new Mirai-based botnet targets vulnerable devices, including Teltonika RUT9XX routers and TP-Link devices. The attacks exploit known vulnerabilities such as CVE-2018-17532 and CVE-2023-1389, putting countless users at risk. Cybersecurity experts warn that this campaign, which began in September, could lead to widespread distributed denial-of-service (DDoS) attacks if not addressed promptly.

Understanding the New Mirai Botnet

The newly identified Mirai variant showcases advanced capabilities, enabling it to execute complex attacks across multiple platforms. Key features include:

• Multi-platform support: Capable of targeting various operating systems.
• Encryption methods: Utilizes ChaCha20 and XOR encryption for enhanced stealth.
• Remote code execution vulnerabilities: Specifically affecting DigiEver DS-2105 Pro network video recorders, which have yet to receive a patch.

Recent Attack Campaigns

Cybersecurity firm Akamai has reported that threat actors have successfully executed command injections through the DigiEver NVR’s vulnerable URI ("/cgi-bin/cgi_main.cgi"). This breach allows them to deploy the new Mirai variant, transforming compromised devices into tools for DDoS attacks.

The tactics employed in these recent attacks show a notable evolution in Mirai-based botnet operations. According to Akamai researchers, the use of sophisticated decryption methods indicates a shift from older, simpler obfuscation techniques.

Comparative Analysis with Previous Attacks

Interestingly, the methods used in these current intrusions bear resemblance to past breaches identified by TXOne researcher Ta-Lun Yen during the previous year’s DefCamp security conference. This connection underscores the persistent threat posed by Mirai botnets, which continue to adapt and evolve.

Protecting Your Devices

To safeguard against these emerging threats, consider the following best practices:

• Regularly update firmware: Ensure all devices are running the latest security updates.
• Change default credentials: Use strong, unique passwords for all network devices.
• Monitor network traffic: Keep an eye on unusual activity that might indicate a breach.

For further insights on device security, refer to resources from the Cybersecurity and Infrastructure Security Agency (CISA) and Krebs on Security.

Conclusion

As cyber threats continue to evolve, staying informed is crucial. The emergence of this new Mirai-based botnet serves as a reminder of the importance of robust security measures. We encourage readers to share their thoughts on this issue and explore our related articles for more information on protecting your network from cyber threats.