New Go-based botnet Zerobot exploits dozens of flaws

Pierluigi Paganini December 07, 2022

Researchers discovered a new Go-based botnet called Zerobot that exploits two dozen security vulnerabilities IoT devices.

Fortinet FortiGuard Labs researchers have discovered a new Go-based botnet called Zerobot that spreads by exploiting two dozen security vulnerabilities in the internet of things (IoT) devices and other applications.

“This botnet, known as Zerobot, contains several modules, including self-replication, attacks for different protocols, and self-propagation.” reads the advisory published by Fortinet. “It also communicates with its command-and-control server using the WebSocket protocol. Based on some IPS signatures trigger count, this campaign started its distribution of the current version sometime after mid-November.

Zerobot targets multiple architectures, including i386, amd64, arm, arm64, mips, mips64, mips64le, mipsle, ppc64, ppc64le, riscv64, and s390x. The bot is saved using the filename “zero.”

The malware first appeared in the wild on November 18, 2022 targeting devices running on Linux operating system.

The researchers discovered two versions of the bot, the first employed in attacks before November 24 that only supports basic functions. The current version includes a “selfRepo” module to spread infecting more endpoints with different protocols or vulnerabilities.

Zerobot botnet

Once infected the system, the bot contacts the remote command-and-control (C2) server and awaits further instructions.

Below is the list of supported commands:

pingHeartbeat, maintaining the connection
attackLaunch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP
stopStop attack
updateInstall update and restart Zerobot
enable_scanScan for open ports and start spreading itself via exploit or SSH/Telnet cracker
disable_scanDisable scanning
commandRunning OS command, cmd on Windows and bash on Linux
killKill botnet program

“Within a very short time, it was updated with string obfuscation, a copy file module, and a propagation exploit module that make it harder to detect and gives it a higher capability to infect more devices.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Zerobot)

[adrotate banner=”5″]

[adrotate banner=”13″]

you might also like

leave a comment