In today's Malware report, a malware-based attack discovered by analysing log files of a public web server is analysed.
The attack consists of exploiting a series of known vulnerabilities through command injection performed within a malicious script, which attempts to download and execute a binary file for different CPU architectures. It will then be able to exploit various vulnerabilities of specific devices.
The main objective of this malware is to compromise Linux systems, especially IoT devices, to create a network of remotely controlled bots called 'zombies'.
The threat is identified as belonging to the malware family Miraiwhich is known to conduct large-scale DDoS attacks. The malware behaves aggressively, targeting remote management processes such as 'telnet' and 'ssh' to prevent access to the infected machine. It also has the ability to generate random IPv4 addresses to start the propagation phase.
Despite the fact that the identified Command & Control (C&C) have already been taken offline, this report provides crucial information to understand how the Mirai malware works and helps stakeholders to implement cyber security measures and mitigate potential threats to their network.
If you wish to learn more, here is the link to our full report.
In addition, you can subscribe to the specific mailing list Cyber Studios by Tinexta Defence, to receive updates on upcoming research: https://tinextadefence.it/mailing-list-cyber-studios/
