Monday, February 10, 2025
HomeBotnetGafgyt Malware Infect Wireless Routers and Recruit into Botnets to Attack Gaming...

Gafgyt Malware Infect Wireless Routers and Recruit into Botnets to Attack Gaming Servers

Published on

SIEM as a Service

Follow Us on Google News

Researchers discovered a new malware variant dubbed Gafgyt infect IoT devices specifically routers used in a small office and home network. The malware variant targets commercial routers like Zyxel, Huawei, and Realtek.

It exploits remote execution code vulnerability in routers to gain access and recruit them to into botnets to attack gaming servers.

Vulnerability Exploited

According to Unit 42 researchers, there are more than 32,000 WiFi routers are vulnerable to the exploits. It abuses the following vulnerabilities to gain access to the routers.

  • CVE-2017-18368 – ZYXEL P660HN-T1A – New in this variant
  • CVE-2017-17215 – Huawei HG532 – Present in JenX as well.
  • CVE-2014-8361 – Realtek RTL81XX Chipset – Present in JenX as well.

The Gafgyt malware active since 2014, it is known for conducting large-scale DDoS attack, the malware includes three scanners that exploit the remote code execution vulnerabilities present on the routers.

Gafgyt
Scanners used in Malware Pic: unit42

The exploits crafted as binary droppers, which downloads the binary from the malicious server based on the router type and try to infect them.

CVE-2017-18368 – ZYXEL P660HN-T1A

The first exploit is a command injection on Zyxel P660HN wireless routers, the command injection vulnerability resides in [ViewLog.asp] page and it can be exploited through the remote_host parameter.

CVE-2017-17215 – Huawei HG532

The second exploit abuses a remote code execution vulnerability found on HG532 routers. the vulnerability can be exploited by an attacker sending malicious packets to TCP port 37215 to launch attacks.

CVE-2014-8361 – Realtek RTL81XX Chipset

The flaw disclosed in 2014 with some Realtek routers which lead to remote code execution.”The miniigd SOAP service, implemented in Realtek SDK, allows remote attackers to execute arbitrary code via a crafted NewInternalClient request,” reads blog post.

The Gafgyt malware variant uses different attack types based on the commands received from the C2 server. Following are the commands

HTTP – HTTP flooding attack
HTTPHex – Aimed to exhaust server resources
HTTPCF – Attack against services secured by Cloudflare
KILLER & KILLATTK – Kills competing botnets
VSE – Payload to attack gaming servers

The gaming servers are the primary target, “payload is widely used to cause a Distributed Reflection Denial of Service (DrDoS), which involves multiple victim machines that unwittingly participate in a DDoS attack.”

Unit 42 observed that the botnets are advertised on social media such as Facebook and Instagram, and the attackers also have their websites to rent the botnets.

The malware samples and DOS attacks are easily obtained by anyone online by just spending a few dollars.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Latest articles

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...

SAML Bypass Authentication on GitHub Enterprise Servers to Login as Other User Account

A severe security vulnerability, tracked as CVE-2025-23369, has been identified in GitHub Enterprise Server...

Marvel Game Vulnerability Exposes PCs & PS5s to Remote Takeover Attacks

A severe security vulnerability has been uncovered in the popular video game Marvel Rivals, raising...