Mirai-Based NoaBot Launches a DDoS Attack on Linux Devices

Hackers use the Mirai botnet to launch large-scale Distributed Denial of Service (DDoS) attacks by exploiting vulnerable Internet of Things (IoT) devices. 

Mirai’s ability to recruit a massive number of compromised devices allows attackers to do the following things to the targeted online services or websites:

  • Dominate
  • Disrupt

Cybersecurity researchers at Akamai recently discovered a new Mirai-based botnet, “NoaBot, ” that is actively attacking Linux devices.

Document
Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Technical Analysis

NoaBot primarily targets Linux IoT devices for DDoS attacks. Mirai botnet was initially identified in 2016, and its source code is publicly available, leading to various variants appearing. 

However, NoaBot initially surfaced in early 2023 and is evolving with:-

  • Obfuscations
  • C2 changes

Not only that even researchers also noted several incidents of dropping P2PInfect worm samples which link both campaigns.

NoaBot mirrors Mirai’s capabilities but diverges in code. Unlike Mirai’s Telnet-based spreader, NoaBot uses SSH with a unique “hi” connection. 

SSH packet with the ‘hi’ string (Source – Akamai)

While embedded song lyrics in early samples remain unexplained, the developers of this botnet removed the lyrics in the later versions. 

NoaBot alters Mirai by employing a distinct SSH credential dictionary and introducing post-breach functions like:-

  • Installing backdoors
  • Spreading to new victims

Unlike Mirai, NoaBot is compiled with uClibc, which helps in altering antivirus detection to SSH scanner or generic trojan signatures, and the following things complicate the reverse engineering:-

  • Statically compiled
  • Symbol-stripped
  • Obfuscates strings

Newer samples introduce command-line arguments, including “noa” for persistence via crontab entry. The “Noa-” prefix in antivirus detections suggests widespread use and the evolution of post-breach operations.

The miner is a self-compiled XMRig variant that extracts configurations before execution. However, instead of using the following things, it introduces code before mining logic:

  • Command line
  • Plaintext

The XMRig configuration usually reveals the following things:

  • Mining pool details
  • Wallet addresses

Apart from this, the threat actors evade detection by dynamically modifying the command line and encrypting the pool details by communicating with Google’s DNS for domain resolution.

In 2023, 849 source IPs globally attacked honeypots, with a notable hotspot in China contributing to 10% of all attacks. 

Global geolocation heatmap of NoaBot attack sources (Source – Akamai)

849 distinct IP addresses hit honeypots in 2023. Their global activity is quite evenly distributed, according to their geolocation data. Given that the software is wormable, it stands to reason that each new victim also becomes an attacker. On the other hand, China is the standout location for all the action.

Recommendations

To secure networks, cybersecurity researchers recommend:

  • Limit SSH access.
  • Always use strong passwords.
  • Do not use any default or used passwords.
  • Shared malware credential sets on GitHub aid protection.
  • Monitor the binary names, process names, and cron jobs to detect the malware.
  • Access IOC CSV files and YARA signatures in the repository.
  • Test environments with an Infection Monkey configuration.
  • Employ the cryptojacking plug-in to assess defenses against stronger credentials.

Try Kelltron’s cost-effective penetration testing services to assess and evaluate the security posture of digital systems –

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LegionLoader Abusing Chrome Extensions To Deliver Infostealer Malware

LegionLoader, a C/C++ downloader malware, first seen in 2019, delivers payloads like malicious Chrome extensions,…

1 day ago

ASUS Critical Vulnerabilities Let Attackers Execute Arbitrary Commands

In a recent security advisory, ASUS has alerted users to critical vulnerabilities affecting several of…

1 day ago

NTT Docomo Hit by DDoS Attack, Services Disrupted for 11 Hours

NTT Docomo, one of Japan’s leading telecommunications and IT service providers, experienced a massive disruption…

1 day ago

Apple Agrees to $95M Settlement Over Siri Privacy Lawsuit

Apple Inc. has agreed to pay $95 million to settle a proposed class-action lawsuit alleging…

1 day ago

iTerm2 Emulator Vulnerability Let Attackers Access Sensitive User Data

 A critical vulnerability discovered in the popular macOS terminal emulator iTerm2 has raised concerns among…

1 day ago

PoC Exploit Released For Critical Windows LDAP RCE Vulnerability

The CVE-2024-49112 vulnerability in Windows LDAP allows remote code execution on unpatched Domain Controllers, as…

2 days ago