New Murdoc_Botnet Targets AVTECH Cameras and Huawei Routers

Title: Surge in Murdoc_Botnet Activity: Cybersecurity Experts Warn of New DDoS Threats

Introduction

Cybersecurity experts are raising alarms about a significant new campaign that targets vulnerabilities in AVTECH IP cameras and Huawei HG532 routers, recruiting these devices into a variant of the Mirai botnet known as Murdoc_Botnet. This large-scale operation has been active since July 2024, compromising over 1,370 systems primarily located in Malaysia, Mexico, Thailand, Indonesia, and Vietnam.

Understanding Murdoc_Botnet’s Threat

The Murdoc_Botnet campaign showcases advanced capabilities, exploiting security flaws like CVE-2017-17215 and CVE-2024-7029 to infiltrate IoT devices. Qualys security researcher Shilpesh Trivedi noted that this campaign effectively compromises devices to build expansive botnet networks.

Key Vulnerabilities Exploited

• CVE-2017-17215
• CVE-2024-7029

These vulnerabilities are leveraged to gain initial access, where a shell script downloads and executes the botnet malware based on the device’s CPU architecture. The primary aim of these attacks is to utilize the botnet for distributed denial-of-service (DDoS) attacks, posing a serious threat to online services.

Recent Developments in DDoS Attacks

Recent reports indicate that another variant of the Mirai botnet, dubbed gayfemboy, has also emerged, exploiting newly discovered security flaws in Four-Faith industrial routers. This variant has been active since early November 2024.

Additionally, a large-scale DDoS attack campaign has targeted major Japanese corporations and banks since late 2024. This attack has affected various sectors including telecommunications, technology, and financial services, with over 55% of the compromised devices located in India.

Key Statistics on Compromised Devices

• India: 55% of compromised devices
• Other affected countries: South Africa, Brazil, Bangladesh, and Kenya.

Characteristics of the Murdoc_Botnet

The botnet comprises malware variants derived from Mirai and BASHLITE. Trend Micro reports that it employs various DDoS attack methods and can update its malware and enable proxy services. The initial infiltration involves loading malware that connects to a command-and-control (C2) server for further instructions.

Protecting Against Murdoc_Botnet and DDoS Attacks

To mitigate the risks associated with this evolving threat, cybersecurity experts recommend:

• Monitoring suspicious processes and network traffic.
• Applying firmware updates regularly.
• Changing default usernames and passwords on devices.

By taking these precautions, users can enhance their defenses against botnet attacks.

Conclusion

As the Murdoc_Botnet campaign continues to evolve, staying informed and implementing security measures is crucial for both individuals and organizations. For more insights on cybersecurity threats and protective strategies, feel free to explore our related articles or share your thoughts in the comments below.

For continued updates on cybersecurity, follow us on Twitter and LinkedIn for more exclusive content.