New Go-based botnet Zerobot exploits dozens of flaws

Researchers discovered a new Go-based botnet called Zerobot that exploits two dozen security vulnerabilities IoT devices.

Fortinet FortiGuard Labs researchers have discovered a new Go-based botnet called Zerobot that spreads by exploiting two dozen security vulnerabilities in the internet of things (IoT) devices and other applications.

“This botnet, known as Zerobot, contains several modules, including self-replication, attacks for different protocols, and self-propagation.” reads the advisory published by Fortinet. “It also communicates with its command-and-control server using the WebSocket protocol. Based on some IPS signatures trigger count, this campaign started its distribution of the current version sometime after mid-November.

Zerobot targets multiple architectures, including i386, amd64, arm, arm64, mips, mips64, mips64le, mipsle, ppc64, ppc64le, riscv64, and s390x. The bot is saved using the filename “zero.”

The malware first appeared in the wild on November 18, 2022 targeting devices running on Linux operating system.

The researchers discovered two versions of the bot, the first employed in attacks before November 24 that only supports basic functions. The current version includes a “selfRepo” module to spread infecting more endpoints with different protocols or vulnerabilities.

Once infected the system, the bot contacts the remote command-and-control (C2) server and awaits further instructions.

Below is the list of supported commands:

Command	Detail
ping	Heartbeat, maintaining the connection
attack	Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP
stop	Stop attack
update	Install update and restart Zerobot
enable_scan	Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker
disable_scan	Disable scanning
command	Running OS command, cmd on Windows and bash on Linux
kill	Kill botnet program

“Within a very short time, it was updated with string obfuscation, a copy file module, and a propagation exploit module that make it harder to detect and gives it a higher capability to infect more devices.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Zerobot)

[adrotate banner=”5″]

[adrotate banner=”13″]