Tuesday, February 11, 2025
HomeComputer SecurityNew Form of Mirai Malware Attacking Cross Platform By leveraging Open-Source Project

New Form of Mirai Malware Attacking Cross Platform By leveraging Open-Source Project

Published on

SIEM as a Service

Follow Us on Google News

A newly discovered different form of Mirai malware leveraging Open-Source Project called Aboriginal Linux to infect multiple cross-platforms such as routers, IP cameras, connected devices, and even Android devices.

Mirai malware has strong records of infecting poorly managing IoT devices and performing DDOS attacks on various platforms.

Mirai Malware(Mirai.linux) initially reported in 2016, since than Malware authors are performing various modification and added the more stealthy techniques to target various platforms.

In order to run the malware on cross-platform, it must be able to run on different architectures without any runtime surprises or misconfiguration.

In this case, the researcher discovered a remote server that contains multiple malware variants that can use for multiple platforms.

Mirai Malware Infection Process & Leveraging Open-Source Projects

The initial stage of infection starts with a shell script that injecting into vulnerable devices and the shell script keeps tries to download from the remote server.

Later it executes the each and ever individual executables one by one and it keeps checking until a binary compliant with the current architecture is found.

shell script downloads executables one by one until it finds one that works with the current architecture

If any one of the executables executed successfully then it will be ultimately responsible for Mirai Payload that will scan the target for devices with default credentials, or vulnerabilities to exploit the target.

According to Symantec, These variants have been created by leveraging an open-source project called Aboriginal Linux that makes the process of cross-compilation easy, effective, and practically fail-proof.

In this case, Malware authors leveraging the legitimate tools such as this cross-platform to effectively achieve the goal of the attack.

It helps to malware variants to become more robust and compatible with multiple architectures and devices.

Also, it will exploit the variety of devices ranging from routers, IP cameras, connected devices, and even Android devices.

when it was executed within the contained environment by the researcher, it attempted to scan more than 500,000 IP addresses generated through the random generation process.

Mitigation

  • Disable features and services that are not required.
  • Disable Telnet login and use SSH where possible.
  • Disable Universal Plug and Play (UPnP) on routers unless absolutely necessary.
  • Perform an audit of IoT devices used on your network.
  • Change the default credentials on devices. Use strong and unique passwords for device accounts and Wi-Fi networks.
  • Use wired connections instead of wireless, where possible.
  • Regularly check the manufacturer’s website for firmware updates.

Also Read:

Mirai Based Botnet “OMG” Turns IoT Device into a Proxy Server

Hackers who created Dangerous Mirai IoT Botnet Plead Guilty

Dangerous Mirai Botnet Attack Attempts Detected Again from 9,000 Unique IP Addresses

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit Valentine’s Day Domains for Sneaky Cyber Attacks

Cybercriminals are capitalizing on the season of love to launch sneaky and deceptive cyberattacks.According...

EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS

Advanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical...

Enhanced IllusionCAPTCHA: Advanced Protection Against AI-Powered CAPTCHA Attacks

As AI technologies continue to evolve, traditional CAPTCHA systems face increasing vulnerabilities.Recent studies...

Akira Ransomware Dominates January 2025 as the Most Active Ransomware Threat

January 2025 marked a pivotal month in the ransomware landscape, with Akira emerging as...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS

Advanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical...

FinStealer Malware Targets Leading Indian Bank’s Mobile Users, Stealing Login Credentials

A new cybersecurity threat has emerged, targeting customers of a prominent Indian bank through...

Researchers Found North Korean Hackers Advanced Tactics, techniques, and procedures

Recent research has highlighted the increasingly sophisticated tactics, techniques, and procedures (TTPs) employed by...