Pierluigi Paganini September 01, 2021

The Mozi botnet continues to spread despite the arrest of its alleged author and experts believe that it will run for many other years. 

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware, it appeared on the threat landscape in late 2019. The Mozi botnet was spotted by security experts from 360 Netlab, at the time of its discovered it was actively targeting Netgear, D-Link, and Huawei routers by probing for weak Telnet passwords to compromise them.

According to the researchers, in the last months of 2019, the botnet was mainly involved in DDoS attacks. It implements a custom extended Distributed Hash Table (DHT) protocol that provides a lookup service similar to a hash table ([key, value]).

This kind of implementation makes it simple to add/remove nodes with minimum workaround re- keys and build a P2P network.

Netlab researchers infected more than 1.5 million systems worldwide, 830,000 are from China. 

Earlier in August, Microsoft researchers reported that the Mozi botnet was improved by implementing news capabilities to target network gateways manufactured by Netgear, Huawei, and ZTE.

Microsoft Security Threat Intelligence Center and Section 52 at Azure Defender for IoT have monitored a new evolution of the threat that extent the list of targets. The bot spreads by brute-forcing devices online or by exploiting known unpatched vulnerabilities in the target devices.

“While the botnet itself is not new, Microsoft’s IoT security researchers recently discovered that Mozi has evolved to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE.” state researchers at Microsoft Security Threat Intelligence Center and Section 52 at Azure Defender for IoT. “By infecting routers, they can perform man-in-the-middle (MITM) attacks—via HTTP hijacking and DNS spoofing—to compromise endpoints and deploy ransomware or cause safety incidents in OT facilities. In the diagram below we show just one example of how the vulnerabilities and newly discovered persistence techniques could be used together. Of course, there are many more possibilities.”

Experts pointed out that Network gateways are privileged targets for threat actors because they can compromise them in order to gain initial access to corporate networks. Once infected a router, threat actors have multiple options, such as to perform man-in-the-middle (MITM) attacks—via HTTP hijacking and DNS spoofing—to compromise endpoints and deploy ransomware.

The capabilities to target Netgear, Huawei, and ZTE gateways allow the bot to increase its resistance to takedown. Experts noticed that the malware also prevent remote access by blocking the following ports used by the above gateways:

In July, Netlab experts helped law enforcement to identify and arrest the alleged author of the Mozi bot.

Unfortunately, despite the arrest of the alleged author, the botnet still lives on due to its P2P infrastructure.

“Now that Mozi’s authors have been taking custody by law enforcement agencies, in which we provided technical assistance throughout, we don’t think it will continue to be updated for quite some time to come. But we know that Mozi uses a P2P network structure, and one of the “advantages” of a P2P network is that it is robust, so even if some of the nodes go down, the whole network will carry on, and the remaining nodes will still infect other vulnerable devices, that is why we can still see Mozi spreading.” reads a new post published by Netlab.

The researchers provided details about the other functional nodes in the Mozi botnet besides the Bot, experts noticed multiple forms of Config files indicating the presence of nodes named sk,ftp,sns,ssh.

For example, the Mozi_ssh is a crypto mining trojan that spreads worm-like through SSH weak password and it uses the same wallet address of nd Mozi_ftp use the same wallet.

“The discovery of Mozi_ftp, Mozi_ssh gives us clear evidence that the Mozi botnet is also trying to profit from mining. From the samples of bot, ftp, and ssh nodes, we can see that their authors have used the “DHT+Config” model as a basic module, and by reusing this module and designing different special tag commands for different functional nodes, they can quickly develop the programs needed for new functional nodes, which is very convenient. This convenience is one of the reasons for the rapid expansion of the Mozi botnet.” continues the post.

Experts noticed that the samples have stopped updating for quite some time, but new devices are infected every day.

NetLab expects the botnet will slightly decrease on weekly basis it will stay alive for some time to come.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Mozi botnet)

[adrotate banner=”5″]

[adrotate banner=”13″]