Tuesday, February 11, 2025
HomeDDOSMirai Based Botnet Moobot Exploit Hikvision Vulnerability

Mirai Based Botnet Moobot Exploit Hikvision Vulnerability

Published on

SIEM as a Service

Follow Us on Google News

Fortinet has recently discovered a malware called Moobot, which was widely distributed through a security vulnerability in a number of Hikvision surveillance or security cameras. Moobot is a variant of the well-known botnet malware Mirai. 

When a victim device is infected, it turns the device into a member of its botnet army, accepts instructions from the threat actors, and launches Distributed Denial of Service (DDoS) attacks against specific targets.

Infection Process

Moobot exploited a vulnerability CVE-2021-36260 in the webserver of Hikvision’s various surveillance cameras to invade. 

A specially crafted message of malicious commands sent to Hikvision devices with this vulnerability, that can yield this vulnerability and inject malicious code for infection.

According to the Fortinet report, The method of attacking Hikvision products is very simple, and it does not even need to pass any login verification procedures, as long as a special attack message is sent to the target device to succeed.

After Moobot got infected, it modify some common commands, such as the “reboot” command used to restart the device, so that the administrator cannot restart the hacked device.

Apart from this, the Moobot features several common elements of Satori, it’s also a variant of Mirai botnet, and in the summer of 2020, the author of Satori got arrested.

Here are the similarities of Moobot with Satori:-

  • Using a separate downloader.
  • The forking of the “/usr/sbin*” process.
  • Overwriting the legitimate “macHelper” file with the Moobot executable.

Floods used

Incorporating the compromised device into a DDoS swarm is the primary goal of Moobot, and in this proceeding to attack the C2 sends several floods with the target IP address and port number.

Here are the floods used by Moobot:-

  • UDP flood
  • ACK flood
  • ACK+PUSH flood
  • SYN flood

However, the vulnerability CVE-2021-36260 has been already fixed in the new version of Hikvision’s firmware launched in September 2021.

But, here, most IoT product owners will hardly update the product, in short, there are still a large number of unpatched products that will be there on the market, which will make it a perfect target for hackers.

While the experts recommended users frequently check whether the products they own have the security updates available or not. Also make sure that the products are updated with the latest version, to avoid becoming the targets of attackers and tools utilized by the hackers to launch attacks.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit Valentine’s Day Domains for Sneaky Cyber Attacks

Cybercriminals are capitalizing on the season of love to launch sneaky and deceptive cyberattacks.According...

EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS

Advanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical...

Enhanced IllusionCAPTCHA: Advanced Protection Against AI-Powered CAPTCHA Attacks

As AI technologies continue to evolve, traditional CAPTCHA systems face increasing vulnerabilities.Recent studies...

Akira Ransomware Dominates January 2025 as the Most Active Ransomware Threat

January 2025 marked a pivotal month in the ransomware landscape, with Akira emerging as...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

CryptoDNA: AI-Powered Cryptojacking Defense Against DDoS Threats in Healthcare IoT

The integration of Internet of Things (IoT) and Internet of Medical (IoM) devices has...

Record Breaking 5.6 Tbps DDoS attack Launched by Mirai Botnet

 The Mirai botnet unleashed a record-breaking Distributed Denial of Service (DDoS) attack on October...

Apache CXF Vulnerability Triggers DoS Attack

Colm O hEigeartaigh announced a critical vulnerability affecting various versions of Apache CXF, a...