Pierluigi Paganini August 20, 2021

Mozi botnet continues to evolve, its authors implemented new capabilities to target Netgear, Huawei, and ZTE network gateways.

Microsoft researchers reported that the Mozi botnet was improved by implementing news capabilities to target network gateways manufactured by Netgear, Huawei, and ZTE.

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware, it appeared on the threat landscape in late 2019. The Mozi botnet was spotted by security experts from 360 Netlab, at the time of its discovered it was actively targeting Netgear, D-Link, and Huawei routers by probing for weak Telnet passwords to compromise them.

According to the researchers, in the last months of 2019, the botnet was mainly involved in DDoS attacks. It implements a custom extended Distributed Hash Table (DHT) protocol that provides a lookup service similar to a hash table ([key, value]).

This kind of implementation makes it simple to add/remove nodes with minimum workaround re- keys and build a P2P network.

Now researchers from Microsoft Security Threat Intelligence Center and Section 52 at Azure Defender for IoT have monitored a new evolution of the threat that extent the list of targets. 

The bot spreads by brute-forcing devices online or by exploiting known unpatched vulnerabilities in the target devices.

“While the botnet itself is not new, Microsoft’s IoT security researchers recently discovered that Mozi has evolved to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE.” state researchers at Microsoft Security Threat Intelligence Center and Section 52 at Azure Defender for IoT. “By infecting routers, they can perform man-in-the-middle (MITM) attacks—via HTTP hijacking and DNS spoofing—to compromise endpoints and deploy ransomware or cause safety incidents in OT facilities. In the diagram below we show just one example of how the vulnerabilities and newly discovered persistence techniques could be used together. Of course, there are many more possibilities.”

Experts pointed out that Network gateways are privileged targets for threat actors because that can compromise them in order to gain initial access to corporate networks. Once infected a router, threat actors have multiple options, such as to perform man-in-the-middle (MITM) attacks—via HTTP hijacking and DNS spoofing—to compromise endpoints and deploy ransomware.

The capabilities to target Netgear, Huawei, and ZTE gateways allow the bot to increase its resistance to takedown. Experts noticed that the malware also prevent remote access by blocking the following ports used by the above gateways:The malware blocks the following TCP ports:

• 23—Telnet
• 2323—Telnet alternate port
• 7547—Tr-069 port
• 35000—Tr-069 port on Netgear devices
• 50023—Management port on Huawei devices
• 58000—Unknown usage

Organizations using Netgear, Huawei, and ZTE network devices are recommended to keep their firmware up to date and use strong passwords.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Mozi botnet)

[adrotate banner=”5″]

[adrotate banner=”13″]