Friday, November 1, 2024
HomeBotnetNew Mozi P2P Botnet Attacks Netgear, GPON, D-Link and Huawei Routers Using...

New Mozi P2P Botnet Attacks Netgear, GPON, D-Link and Huawei Routers Using Weak Passwords and Some Known Exploits

Published on

Malware protection

A new Distributed Hash Table (DHT) protocol based botnet dubbed Mozi attacks routers with weak passwords and known exploits. The botnet appears to be active at least from September 03, 2019.

DHT is a decentralized distributed that provides lookup service similar to key pair stored in DHT and retrieves a value based on the associated key. The protocol is mainly used in torrent clients and other peer-to-peer file-sharing platforms.

Mozi Botnet uses DHT protocol to quickly establish a network and to hide the payload with a vast amount of regular DHT traffic.

- Advertisement - SIEM as a Service
Mozi Botnet
Mozi Botnet Traffic

Mozi Botnet

Security researchers at 360 Netlab discovered a suspicious file that reuses part of the Gafgyt malware code, further analysis reveals that “P2P botnet implemented based on the DHT protocol, researchers called it as Mozi based on its propagation sample.”

The botnet relies on the custom P2P network, uses ECDSA384 and the xor algorithm to ensure integrity and security. The botnet can perform the following functions

  • DDoS attack
  • Collecting Bot Information
  • Execute the payload of the specified URL
  • Update the sample from the specified URL
  • Execute system or custom commands
Mozi Botnet
Mozi Structure

The botnet starts infection using any random local port to start a local HTTP service to provide malware samples for download or to retrieve the samples from the address present in the config file. It uses weak passwords or uses known to compromise the targeted device.

Following are the vulnerabilities Exploited

VULNERABILITYAFFECTED DEVICE
Eir D1000 Wireless Router RCIEir D1000 Router
Vacron NVR RCEVacron NVR devices
CVE-2014-8361Devices using the Realtek SDK
Netgear cig-bin Command InjectionNetgear R7000 and R6400
Netgear setup.cgi unauthenticated RCEDGN1000 Netgear routers
JAWS Webserver unauthenticated shell command executionMVPower DVR
CVE-2017-17215Huawei Router HG532
HNAP SoapAction-Header Command ExecutionD-Link Devices
CVE-2018-10561, CVE-2018-10562GPON Routers
UPnP SOAP TelnetD Command ExecutionD-Link Devices
CCTV/DVR Remote Code ExecutionCCTV DVR

Once it infected the target device, it joins the device Mozi P2P network and the device becomes like the new Mozi Bot node and starts infecting other devices.

Based on the data collected by 360 Netlab honeypot devices, the campaign is ongoing and the infection has been increasing.

Mozi Botnet
Device Infection

Users are recommended to patch the vulnerabilities and to set up a strong password to avoid infection. Technical details can be found in the 360 Netlab blog post.

For more information on D-Link, Firmware Patches refer here.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Russia-Linked Hackers Attacking Governmental And Political Organizations

Two pro-Russian threat actors launched a distributed denial-of-service (DDoS) attack campaign against Japanese organizations...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

GorillaBot Emerged As King For DDoS Attacks With 300,000+ Commands

The newly emerged Gorilla Botnet has exhibited unprecedented activity, launching over 300,000 DDoS attacks...