Friday, November 1, 2024
HomeCyber AttackMirai-Based NoaBot Launches a DDoS Attack on Linux Devices

Mirai-Based NoaBot Launches a DDoS Attack on Linux Devices

Published on

Malware protection

Hackers use the Mirai botnet to launch large-scale Distributed Denial of Service (DDoS) attacks by exploiting vulnerable Internet of Things (IoT) devices. 

Mirai’s ability to recruit a massive number of compromised devices allows attackers to do the following things to the targeted online services or websites:

  • Dominate
  • Disrupt

Cybersecurity researchers at Akamai recently discovered a new Mirai-based botnet, “NoaBot, ” that is actively attacking Linux devices.

- Advertisement - SIEM as a Service
Document
Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Technical Analysis

NoaBot primarily targets Linux IoT devices for DDoS attacks. Mirai botnet was initially identified in 2016, and its source code is publicly available, leading to various variants appearing. 

However, NoaBot initially surfaced in early 2023 and is evolving with:-

  • Obfuscations
  • C2 changes

Not only that even researchers also noted several incidents of dropping P2PInfect worm samples which link both campaigns.

NoaBot mirrors Mirai’s capabilities but diverges in code. Unlike Mirai’s Telnet-based spreader, NoaBot uses SSH with a unique “hi” connection. 

SSH packet with the ‘hi’ string (Source – Akamai)

While embedded song lyrics in early samples remain unexplained, the developers of this botnet removed the lyrics in the later versions. 

NoaBot alters Mirai by employing a distinct SSH credential dictionary and introducing post-breach functions like:-

  • Installing backdoors
  • Spreading to new victims

Unlike Mirai, NoaBot is compiled with uClibc, which helps in altering antivirus detection to SSH scanner or generic trojan signatures, and the following things complicate the reverse engineering:-

  • Statically compiled
  • Symbol-stripped
  • Obfuscates strings

Newer samples introduce command-line arguments, including “noa” for persistence via crontab entry. The “Noa-” prefix in antivirus detections suggests widespread use and the evolution of post-breach operations.

The miner is a self-compiled XMRig variant that extracts configurations before execution. However, instead of using the following things, it introduces code before mining logic:

  • Command line
  • Plaintext

The XMRig configuration usually reveals the following things:

  • Mining pool details
  • Wallet addresses

Apart from this, the threat actors evade detection by dynamically modifying the command line and encrypting the pool details by communicating with Google’s DNS for domain resolution.

In 2023, 849 source IPs globally attacked honeypots, with a notable hotspot in China contributing to 10% of all attacks. 

Global geolocation heatmap of NoaBot attack sources (Source – Akamai)

849 distinct IP addresses hit honeypots in 2023. Their global activity is quite evenly distributed, according to their geolocation data. Given that the software is wormable, it stands to reason that each new victim also becomes an attacker. On the other hand, China is the standout location for all the action.

Recommendations

To secure networks, cybersecurity researchers recommend:

  • Limit SSH access.
  • Always use strong passwords.
  • Do not use any default or used passwords. 
  • Shared malware credential sets on GitHub aid protection. 
  • Monitor the binary names, process names, and cron jobs to detect the malware. 
  • Access IOC CSV files and YARA signatures in the repository. 
  • Test environments with an Infection Monkey configuration.
  • Employ the cryptojacking plug-in to assess defenses against stronger credentials.

Try Kelltron’s cost-effective penetration testing services to assess and evaluate the security posture of digital systems –

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling...

Hardcoded Creds in Popular Apps Put Millions of Android and iOS Users at Risk

Recent analysis has revealed a concerning trend in mobile app security: Many popular apps...