D-Link Vulnerabilities Fuels Global Botnet Attacks

December 27, 2024December 27, 2024

Spike in D-Link Router Attacks: Cybersecurity Experts Warn of New Botnets

Cybersecurity researchers have issued a stark warning about a recent surge in malicious activities targeting vulnerable D-Link routers. These attacks involve two distinct botnets: a Mirai variant known as FICORA and a Kaiten variant called CAPSAICIN. As these cyber threats evolve, it’s crucial for users to remain vigilant and proactive in securing their networks.

According to Fortinet FortiGuard Labs researcher Vincent Li, these botnets exploit documented vulnerabilities in D-Link routers, allowing remote attackers to execute harmful commands via the Home Network Administration Protocol (HNAP). This HNAP weakness was first revealed nearly a decade ago, impacting numerous devices with various CVE numbers, including CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and the newly identified CVE-2024-33112.

Global Impact of FICORA and CAPSAICIN Botnets

Telemetry data from Fortinet indicates that FICORA botnet attacks have been observed across various countries, while CAPSAICIN has primarily targeted regions in East Asia, notably Japan and Taiwan. Notably, CAPSAICIN activity intensified between October 21 and 22, 2024, highlighting its aggressive nature.

Mechanisms of Attack

The FICORA botnet facilitates the deployment of a downloader shell script named “multi” from a remote server with the IP address 103.149.87[.]69. This script is designed to fetch the main payload compatible with different Linux architectures using commands such as wget, ftpget, curl, and tftp. Furthermore, the malware includes a brute-force attack feature with a preset list of usernames and passwords. This Mirai derivative is also equipped to conduct distributed denial-of-service (DDoS) attacks utilizing UDP, TCP, and DNS protocols.

Similarly, CAPSAICIN employs a downloader script called “bins.sh,” which operates from a different IP address, 87.10.220[.]221. This approach mirrors FICORA’s strategy, ensuring compatibility across various Linux systems.

Key Functions of CAPSAICIN Malware

Once installed, CAPSAICIN takes control of the compromised device, executing commands from its command-and-control (C2) server, 192.110.247[.]46. The botnet can perform a range of malicious tasks, including:

GETIP: Retrieve the device’s IP address
CLEARHISTORY: Erase command history
RNDNICK: Change the victim host’s nickname randomly
ENABLE: Activate the bot
KILLMYEYEPEEUSINGHOIC: Terminate the original malware

Li emphasizes that despite the vulnerabilities being known and patched almost a decade ago, these attacks continue to pose a significant threat globally.

Importance of Regular Updates

To mitigate the risk of falling victim to these botnets, it is essential for enterprises and home users alike to regularly update their devices’ firmware and maintain vigilant monitoring of their networks.

For more information on securing your devices against cyber threats, visit Fortinet’s official blog or read about the latest in cybersecurity best practices.

Have you experienced any suspicious activity on your network? Share your thoughts in the comments below, and follow us on Twitter and LinkedIn for more updates on cybersecurity trends and tips.

Iranian Malware Tied to Attacks on US, Israeli Systems

December 13, 2024December 13, 2024

Researchers from Claroty Team82 have identified a new malware called IOCONTROL linked to the Iranian CyberAv3ngers, a group previously associated with attacks on water systems in the U.S. and Israel. This malware targets various IoT and operational technology devices, including IP cameras, routers, and programmable logic controllers, posing a significant threat to critical infrastructure. The CyberAv3ngers, linked to the Islamic Revolutionary Guard Corps, aim to disrupt essential resources. IOCONTROL’s modular design allows it to target multiple manufacturers, complicating detection and mitigation efforts. Experts emphasize the need for heightened cybersecurity measures to safeguard against these evolving threats.

Cloud Atlas Targets Russia with New VBCloud Malware

December 27, 2024December 27, 2024

In 2024, the cyber threat group Cloud Atlas has begun using a new malware strain called VBCloud, primarily targeting users in Russia through phishing emails that exploit a Microsoft Office vulnerability (CVE-2018-0802). This malware infects systems by downloading harmful code via malicious documents, leading to data theft and system monitoring. Over 80% of victims are in Russia, with others in countries like Canada and Turkey. The attack chain involves the installation of the VBShower backdoor, which retrieves additional payloads. Experts stress the importance of enhanced cybersecurity measures to combat these evolving threats.

Shared Digital Gateway Linked to Three NHS Ransomware Attacks

December 10, 2024December 10, 2024

Alder Hey Children’s Hospital fell victim to a ransomware attack linked to the INC Ransom gang, exploiting the Citrix Bleed vulnerability (CVE-2023-4966). This vulnerability, which allows session hijacking and data disclosure, has become a common target for cybercriminals, particularly in ransomware incidents. Experts like Rafe Pilling from Secureworks highlight the opportunistic nature of these attacks, emphasizing the vulnerability of healthcare institutions. Since its emergence in July 2023, INC Ransom has rapidly targeted sectors like healthcare, education, and industry. To combat these threats, organizations are urged to implement strong cybersecurity measures, including regular backups and AI anomaly detection.

Netis Routers Face Serious Authentication and RCE Vulnerabilities

January 8, 2025January 8, 2025

Recent research has uncovered critical vulnerabilities in various Netis router models, including NX10 and MW5360, posing risks like information disclosure, authentication bypass, and remote code execution (RCE). The vulnerabilities, reported by cybersecurity expert h00die-gr3y, include CVE-2024-48456, which allows attackers to hijack the admin password reset feature, and CVE-2024-48457, enabling unauthorized password changes. These flaws can be exploited in tandem, compromising user security. As no fixes are available from Netis, users are urged to change default passwords, monitor network activity, and regularly check for firmware updates to safeguard their devices against potential cyber threats.

APT-C-60 Hackers Use Job Scam to Deploy SpyGlace Malware

December 1, 2024December 12, 2024

APT-C-60, a South Korean cyber espionage group, has launched a sophisticated attack on an unnamed Japanese organization, using a job application lure to distribute SpyGlace malware. This incident, reported by JPCERT/CC, occurred in August 2024 and involved exploiting a vulnerability in WPS Office. The phishing scheme included an email with a malicious link to a file on Google Drive, which, when opened, activated a downloader that installed the malware. The use of legitimate services highlights evolving cyber tactics, emphasizing the need for enhanced cybersecurity measures to combat such threats.

12 Questions CNI Operators Must Ask OT Suppliers

January 13, 2025January 13, 2025

CISA Director Jen Easterly has called for enhanced software security, comparing it to the automotive industry’s shift towards mandatory seatbelts. She emphasizes that the current crisis is a software quality issue rather than a cybersecurity problem. To improve software security, consumers must demand secure design as a standard, similar to safety campaigns in the past. As companies increasingly assign Chief Information Security Officers to oversee operational technology (OT) security, they face unique challenges from cyber attacks, insider threats, and legacy systems. Implementing best practices such as regular audits and employee training is essential for mitigating these risks and fostering a secure digital environment.