Juniper Networks has warned clients of Mirai malware assaults scanning the Web for Session Good routers utilizing default credentials.
Because the networking infrastructure firm defined, the malware scans for gadgets with default login credentials and executes instructions remotely after gaining entry, enabling a variety of malicious actions.
The marketing campaign was first noticed on December 11, when the primary contaminated routers have been discovered on clients’ networks. Later, the operators of this Mirai-based botnet used the compromised gadgets to launch distributed denial-of-service (DDoS) assaults.
“On Wednesday, December 11, 2024, a number of clients reported suspicious conduct on their Session Good Community (SSN) platforms,” says a safety advisory printed this Tuesday.
“Any buyer not following advisable greatest practices and nonetheless utilizing default passwords could be thought of compromised because the default SSR passwords have been added to the virus database.”
Juniper additionally shared indicators of compromise admins ought to search for on their networks and gadgets to detect potential Mirai malware exercise, together with:
- scans for gadgets on frequent Layer 4 ports (e.g., 23, 2323, 80, 8080),
- failed login makes an attempt on SSH companies indicative of brute-force assaults,
- sudden spike in outbound site visitors quantity hinting at gadgets being co-opted in DDoS assaults,
- gadgets rebooting or behaving erratically, suggesting they have been compromised,
- SSH connections from identified malicious IP addresses.
The corporate suggested clients to right away guarantee their gadgets observe advisable username and password insurance policies, together with altering the default credentials on all Session Good routers and utilizing distinctive and powerful passwords throughout all gadgets.
Admins are additionally advisable to maintain firmware up to date, assessment entry logs for anomalies, set alerts mechanically triggered when suspicious exercise is detected, deploy intrusion detection methods to watch community exercise, and use firewalls to dam unauthorized entry to Web-exposed gadgets.
Juniper additionally warned that routers already contaminated in these assaults have to be reimaged earlier than being introduced again on-line.
“If a system is discovered to be contaminated, the one sure approach of stopping the menace is by reimaging the system because it can’t be decided precisely what may need been modified or obtained from the system,” Juniper stated.
Final yr, in August, the ShadowServer menace monitoring service warned of ongoing assaults focusing on a essential distant code execution exploit chain impacting Juniper EX switches and SRX firewalls utilizing a watchTowr Labs proof-of-concept (PoC) exploit.
Since then, Juniper additionally warned of a essential RCE bug in its firewalls and switches in January and launched an out-of-cycle patch for a maximum-severity authentication bypass flaw in its Session Good Router (SSR), Session Good Conductor, and WAN Assurance Router merchandise.
Replace December 20, 03:17 EST: Revised article and title to explain the assaults as scanning exercise.