Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

TheMoon botnet was first identified in 2014 and it targets exploits on the router developed by companies such as Linksys, ASUS, MikroTik and D-Link.

The botnet operators used the proxy botnet for various activities such as brute forc, video advertisement fraud, general traffic obfuscation and more.

To expand the botnet the threat actor will continuously scan for vulnerable services running on IoT devices and if they detect any vulnerable device it then drops a shell script.

TheMoon botnet targets IoT applications running on port 8080 and the once the dropped shell script executed it downloads the initial stages of the payload.

Security researchers from CenturyLink found the new module is different from the previous one, the new module turns the infected device into a SOCKS5 proxy. The new module allows the botnet author to sell its proxy network as a service to others.

CenturyLink discovered that each IP hosted on TCP port 8002 When connecting to this port, a stream of log messages associated with a video advertisement fraud campaign was automatically received.

“One six-hour time period from a single server resulted in requests to 19,000 unique URLs on 2,700 unique domains. After browsing some of the URLs, it was apparent they all had embedded YouTube videos.”

The IP key has a base64 encoded string and it represents the proxy used for the video ad fraud request.

Centurylink blocked the TheMoon infrastructure on it’s ISP network and it notified another other network operators to potentially block the infected devices. Further details and IoC can be found in Century link report.

“The always-on nature of IoT devices and the ability to masquerade as normal home users make broadband networks prime targets for these types of attacks,” reads CenturyLink report.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

New Hacking Group Outlaw Distributing Botnet to Scan The Network & Perform Cryptocurrency-Mining & Brute-Force Attack

Hackers Exploiting ThinkPHP Vulnerability To Expand Hakai and Yowai Botnets

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

12 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

12 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

15 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

19 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

19 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

20 hours ago