#threatreport #LowCompleteness
Mass Campaign of Murdoc Botnet Mirai: A New Variant of Corona Mirai | 21-01-2025
Source:Key details below ↓

🧑‍💻Actors/Campaigns:
Murdoc_botnet
Meow

💀Threats:
Mirai, Gtfobins_tool, 
🎯Victims: Avtech cameras, Huawei hg532 routers

🏭Industry: Iot

🌐Geo: Malaysia, Thailand, Mexico, Indonesia

🔓CVEs: CVE-2017-17215  \[[Vulners](- CVSS V3.1: *8.8*, 
 - Vulners: Exploitation: True
    Soft:
 - huawei hg532 firmware (-)

CVE-2024-7029  \[[Vulners](- CVSS V3.1: *9.8*, 
 - Vulners: Exploitation: True
    Soft:
 - avtech avm1203 firmware (lefullimg-1023-1007-1011-1009)

🤖LLM extracted TTPs:`
T1496, T1210, T1059.004, T1105

🧨IOCs:
 - Hash: 35
 - IP: 75

🔢Algorithms: base64

💻Platforms: x86

#threatreport:
The Qualys Threat Research Unit has recently identified a significant operation within the Mirai campaign, which they have named the Murdoc Botnet. This new variant of Mirai exploits vulnerabilities in AVTECH Cameras and Huawei HG532 routers, demonstrating advanced capabilities in compromising devices and establishing widespread botnet networks. The Murdoc Botnet utilizes techniques such as ELF file and Shell Script execution to deploy the botnet sample, a method previously observed in a 2024 attack where attackers exploited the same vulnerabilities to load malware onto targeted devices.

The research team at Qualys discovered evidence of an active Mirai campaign starting in July 2024. They found over 100 distinct sets of servers involved in deciphering activities and communicating with compromised IPs implicated in the ongoing campaign, facilitating the distribution of Mirai malware. These command-and-control servers are detailed with specific payload content leading to the final URL where the Mirai malware is dropped.

The Murdoc Botnet, also known as Mirai malware, specifically targets *nix systems and vulnerable AVTECH and Huawei devices. It leverages known exploits like CVE-2024-7029 and CVE-2017-17215 to download subsequent payloads. The malware uses command line injections for AVTECH cameras, along with ELF files and ShellScript files. These scripts are loaded onto various devices like IP cameras, network devices, and IoT devices by the C2 server to introduce the new Murdoc Botnet variant. The infection flow remains consistent across analyzed samples.

Analyzing the IP addresses associated with the campaign, the Qualys Threat Research Team identified the geographical impact, with Malaysia being the most affected country, followed by Thailand, Mexico, and Indonesia. Qualys Endpoint Detection and Response (EDR) system is capable of detecting the Murdoc Botnet Mirai variant, providing crucial visibility into potential threats.

The research process involved dissecting Murdoc Botnet binaries used for DDoS activities, leading to the attribution of Murdoc Botnet as a Mirai variant through the use of Qualys EDR, threat intelligence data, and open-source intelligence (OSINT). To protect against such attacks, enterprise users and administrators are advised to implement the recommended security measures outlined by the researchers.
#threatreport
#threatreport #LowCompleteness