Palo Alto researchers uncovered a series of ongoing attacks to spread a variant of the infamous Mirai bot exploiting multiple vulnerabilities.

Security experts at Palo Alto Networks disclosed a series of attacks aimed at delivering a Mirai variant leveraging multiple vulnerabilities.

Below the list of vulnerabilities exploited in the attacks, three of which were unknown issues:

IDVulnerabilityDescriptionSeverity1VisualDoorSonicWall SSL-VPN Remote Command Injection VulnerabilityCritical2CVE-2020-25506D-Link DNS-320 Firewall Remote Command Execution VulnerabilityCritical3CVE-2021-27561 and CVE-2021-27562Yealink Device Management Pre-Auth ‘root’ Level Remote Code Execution VulnerabilityCritical4CVE-2021-22502Remote Code Execution Vulnerability in Micro Focus Operation Bridge Reporter (OBR), affecting version 10.40Critical5CVE-2019-19356Resembles the Netis WF2419 Wireless Router Remote Code Execution VulnerabilityHigh6CVE-2020-26919Netgear ProSAFE Plus Unauthenticated Remote Code Execution VulnerabilityCritical7UnidentifiedRemote Command Execution Vulnerability Against an Unknown TargetUnknown8UnidentifiedRemote Command Execution Vulnerability Against an Unknown TargetUnknown9Unknown VulnerabilityVulnerability Used by Moobot in the Past, Although the Exact Target is Still UnknownUnknown“The attacks are still ongoing at the time of this writing. Upon successful exploitation, the attackers try to download a malicious shell script, which contains further infection behaviors such as downloading and executing Mirai variants and brute-forcers.” reads a post published by Palo Alto Networks’ Unit 42.

The attacks were first observed on February 16, experts noticed that upon successful exploitation, the malicious code uses the wget utility to download a shell script from the C2. The shell script downloads several Mirai binaries that were compiled for different architectures, then it executes these binaries one by one.

Experts noticed that the malware also downloads more shell scripts that retrieve brute-forcers that could be used to target devices protected with weak passwords.

“The IoT realm remains an easily accessible target for attackers. Many vulnerabilities are very easy to exploit and could, in some cases, have catastrophic consequences,” the researchers conclude.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, Mirai)

The post New Mirai variant appears in the threat landscape appeared first on Security Affairs.