Saturday, June 22, 2024

Mirai-Based NoaBot Launches a DDoS Attack on Linux Devices

Hackers use the Mirai botnet to launch large-scale Distributed Denial of Service (DDoS) attacks by exploiting vulnerable Internet of Things (IoT) devices. 

Mirai’s ability to recruit a massive number of compromised devices allows attackers to do the following things to the targeted online services or websites:

  • Dominate
  • Disrupt

Cybersecurity researchers at Akamai recently discovered a new Mirai-based botnet, “NoaBot, ” that is actively attacking Linux devices.

Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Technical Analysis

NoaBot primarily targets Linux IoT devices for DDoS attacks. Mirai botnet was initially identified in 2016, and its source code is publicly available, leading to various variants appearing. 

However, NoaBot initially surfaced in early 2023 and is evolving with:-

  • Obfuscations
  • C2 changes

Not only that even researchers also noted several incidents of dropping P2PInfect worm samples which link both campaigns.

NoaBot mirrors Mirai’s capabilities but diverges in code. Unlike Mirai’s Telnet-based spreader, NoaBot uses SSH with a unique “hi” connection. 

SSH packet with the ‘hi’ string (Source – Akamai)

While embedded song lyrics in early samples remain unexplained, the developers of this botnet removed the lyrics in the later versions. 

NoaBot alters Mirai by employing a distinct SSH credential dictionary and introducing post-breach functions like:-

  • Installing backdoors
  • Spreading to new victims

Unlike Mirai, NoaBot is compiled with uClibc, which helps in altering antivirus detection to SSH scanner or generic trojan signatures, and the following things complicate the reverse engineering:-

  • Statically compiled
  • Symbol-stripped
  • Obfuscates strings

Newer samples introduce command-line arguments, including “noa” for persistence via crontab entry. The “Noa-” prefix in antivirus detections suggests widespread use and the evolution of post-breach operations.

The miner is a self-compiled XMRig variant that extracts configurations before execution. However, instead of using the following things, it introduces code before mining logic:

  • Command line
  • Plaintext

The XMRig configuration usually reveals the following things:

  • Mining pool details
  • Wallet addresses

Apart from this, the threat actors evade detection by dynamically modifying the command line and encrypting the pool details by communicating with Google’s DNS for domain resolution.

In 2023, 849 source IPs globally attacked honeypots, with a notable hotspot in China contributing to 10% of all attacks. 

Global geolocation heatmap of NoaBot attack sources (Source – Akamai)

849 distinct IP addresses hit honeypots in 2023. Their global activity is quite evenly distributed, according to their geolocation data. Given that the software is wormable, it stands to reason that each new victim also becomes an attacker. On the other hand, China is the standout location for all the action.


To secure networks, cybersecurity researchers recommend:

  • Limit SSH access.
  • Always use strong passwords.
  • Do not use any default or used passwords. 
  • Shared malware credential sets on GitHub aid protection. 
  • Monitor the binary names, process names, and cron jobs to detect the malware. 
  • Access IOC CSV files and YARA signatures in the repository. 
  • Test environments with an Infection Monkey configuration.
  • Employ the cryptojacking plug-in to assess defenses against stronger credentials.

Try Kelltron’s cost-effective penetration testing services to assess and evaluate the security posture of digital systems –


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles