The Mirai-based Moobot botnet is rapidly spreading by exploiting a critical command injection flaw, tracked as CVE-2021-36260, in the webserver of several Hikvision products. The Moobot was first documented by Palo Alto Unit 42 researchers in February 2021, the recent attacks demonstrated that its authors are enhancing their malware.
The critical issue affects more than 70 Hikvision camera and NVR models and can allow attackers to take over the devices. The vulnerability is an unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware, it was discovered by a security researcher that goes online with the moniker “Watchful IP.”
Upon compromising the IP camera, an attacker can also use the hacked device to access internal networks posing a risk to the infrastructure that uses the devices.
The researcher pointed out that the exploitation of the issue doesn’t require user interaction, the attacker only needs access to the http(s) server port (typically 80/443).
The expert pointed out that every firmware developed since 2016 has been tested and found to be vulnerable.
According to Hikvision, the vulnerability is due to insufficient input validation and can be exploited by sending specially crafted messages to vulnerable devices.
The company states that the attacker can exploit the flaw only if he has access to the device network or the device has direct interface with the Internet. The vulnerability was reported to the vendor in June, the company released firmware updates on September 19.
The vulnerability was exploited by botnet operators to extract sensitive data from unpatched devices, Fortinet researchers reported.
“During our analysis, we observed numerous payloads attempting to leverage this vulnerability to probing the status of devices or extracting sensitive data from victims. One payload in particular caught our attention. It tries to drop a downloader that exhibits infection behavior and that also executes Moobot, which is a DDoS botnet based on Mirai.” reads the analysis published by Fortinet.
Fortinet researchers spotted a downloader for the Moobot malware with the “hikivision” parameter, it saves final payload as “macHelper.”
The malware also modifies basic commands like “reboot” to prevent an administrator from rebooting the infected device.
Fortinet researchers found similarities between Moobot and Mirai, they also discovered that Moobot borrows some elements from the Satori botnet.
Moobot is a DDoS botnet that supports multiple attack methods.
The analysis of captured packet data, allowed Fortinet researchers to track down a Telegram channel used to advertise DDoS services since August.
“Although a patch has been released to address this vulnerability, this IoT botnet will never stop looking for a vulnerable end point. Because of this, users should upgrade affected devices immediately as well as apply FortiGuard protection.” concludes Fortinet.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, botnet)
[adrotate banner=”5″]
[adrotate banner=”13″]
China-linked threat actors are preparing cyber attacks against U.S. critical infrastructure warned FBI Director Christopher…
The United Nations Development Programme (UNDP) has initiated an investigation into an alleged ransomware attack…
BlackBerry reported that the financially motivated group FIN7 targeted the IT department of a large…
An international law enforcement operation led to the disruption of the prominent phishing-as-a-service platform LabHost.…
Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since…
Cisco has addressed a high-severity vulnerability in its Integrated Management Controller (IMC) for which publicly…
This website uses cookies.
