DigiEver IoT Units Exploited To Ship Mirai-based Malware

A brand new Mirai-based botnet, “Hail Cock Botnet,” has been exploiting susceptible IoT units, together with DigiEver DVRs and TP-Hyperlink units with CVE-2023-1389.

The botnet, lively since September 2024, leverages a variant of Mirai malware with enhanced encryption. 

A current uptick in assaults focusing on the URI /cgi-bin/cgi_main.cgi, exploiting an RCE vulnerability in DigiEver DS-2105 Professional units, aligns with this marketing campaign. Whereas the vulnerability lacks a CVE, it was beforehand disclosed by Ta-Lun Yen of TXOne Analysis.

– Commercial –

The researcher recognized susceptible DigiEver DVRs uncovered on-line and by analyzing the firmware, they found the `/cgi-bin/cgi_main.cgi` endpoint.

Exploiting this endpoint, they efficiently executed arbitrary code on the susceptible units, probably enabling distant management or information theft.

It was found focusing on units with identified vulnerabilities and exploiting command injection flaws in DigiEver routers (/cfg_system_time.htm ntp parameter), TP-Hyperlink routers (/cgi-bin/luci;stok=/locale endpoint), and Tenda HG6 routers (/boaform/admin/formTracert). 

2024 MITRE ATT&CK Analysis Outcomes for SMEs & MSPs -> Obtain Free Information

The botnet injects instructions to obtain malicious scripts from distant servers, which then fetch and execute Mirai-based malware, the place the attackers additionally goal different vulnerabilities like CVE-2018-17532 utilizing comparable strategies.  

The Mirai-based malware samples analyzed employed a complicated multi-layer encryption scheme, combining XOR and ChaCha20 algorithms, which, whereas not completely novel, demonstrates a transparent evolution within the ways of botnet operators. 

It’s capacity to decrypt important strings, comparable to botnet affiliation messages and default machine credentials, highlights the growing complexity of those threats and by leveraging superior cryptographic strategies, the malware goals to evade detection and hinder evaluation efforts, thereby increasing its attain and affect. 

Akamai analyzed malware samples in a sandbox atmosphere and noticed persistence mechanisms, the place the malware creates a cron job to obtain a shell script named “wget.sh” from “hailcocks.ru” and executes it, which probably establishes communication with the botnet’s C2 server at “kingstonwikkerink.dyn.” 

The malware additionally leaves a fingerprint within the console, with older variations asserting its affiliation to “hail cock botnet” and newer ones displaying a seemingly innocent message, “I simply wanna take care of my cats, man.”. 

As evidenced by the current operation of the Hail Cock botnet, cybercriminals create botnets by using out of date {hardware} and firmware, the place units just like the 10-year-old DigiEver DS-2105 Professional, missing producer assist for safety patches, are prime targets. 

To mitigate dangers, customers ought to improve susceptible units to newer, safer fashions, particularly when producers stop offering updates. 

Examine Actual-World Malicious Hyperlinks, Malware & Phishing Assaults With ANY.RUN – Attempt for Free