Mirai Evolves From IoT Devices to Linux Servers

  /     /     /  
Publicated : 23/11/2024   Category : security


Mirai Evolves From IoT Devices to Linux Servers


Netscout says it has observed at least one dozen Mirai variants attempting to exploit a recently disclosed flaw in Hadoop YARN on Intel servers.



Researchers from Netscout Alert have discovered what they believe are the first non-IoT versions of Mirai malware in the wild.
The new versions are very similar in behavior to the original version of Mirai written for Internet of Things devices, but they are tailored to run on Linux servers instead. Unlike the original Mirai, the new versions do not try and propagate in a worm-like fashion. Instead, attackers are delivering them via exploits in a more targeted manner.
Netscout researchers say they have observed what appears to be a relatively small number of threat actors attempting to deliver the malware on Linux servers by exploiting a recently disclosed vulnerability in Hadoop YARN. The YARN vulnerability is a command injection flaw that gives attackers a way to remotely execute arbitrary shell commands on a vulnerable server. Many of the servers running Hadoop YARN are x86-based.
Netscout has been tracking attempts to exploit the flaw using its global network of honeypots. It says it has observed tens of thousands of exploit attempts daily. In November alone, Netscout observed attackers attempting to deliver some 225 unique malicious payloads via the Hadoop YARN vulnerability.
Of that, at least one dozen of the malware samples were Mirai variants. One was a variant that labeled itself as VPNFilter, though it had nothing to do with the destructive VPNFilter bot that infected more than a half-million small and home office routers earlier this year, the security vendor 
said
.
Unlike typical Mirai IoT variants, which first try and determine a victim machines CPU architecture to deliver a suitable executable, the Mirai variant that Netscout inspected recently only delivers the x86 variant of the bot. This version assumes the Hadoop YARN service is running on a commodity x86 Linux server, Netscout says in its report. Once gaining a foothold, Mirai on a Linux server behaves much like an IoT bot and begins brute-forcing telnet usernames and passwords.  
Matthew Bing, a security research analyst at Netscout, says the main takeaway for organizations is that threat actors who were once focused on exploiting IoT devices are now also targeting vulnerable Linux servers with the same types of bots. Servers make an attractive target for DDoS bots for their network speed and hardware resources, compared to relatively underpowered IoT devices, Bing says.
The sources that are launching the attacks appear to be operating across a variety of different countries and networks with little overlap between them. That suggests this is the work of at least a few groups or individuals, he says.
Related Content:
Destructive VPNFilter Attack Network Uncovered
7 Variants (So Far) of Mirai
New Mirai Variants Leverage Open Source Project
Mirai Authors Escape Jail Time – But Here Are 7 Other Criminal Hackers Who Didnt
 
Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
 and
to register.

Last News

▸ Beware EMV may not fully protect against skilled thieves. ◂
Discovered: 23/12/2024
Category: security

▸ Hack Your Hotel Room ◂
Discovered: 23/12/2024
Category: security

▸ Website hacks happened during World Cup final. ◂
Discovered: 23/12/2024
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
Mirai Evolves From IoT Devices to Linux Servers