The market fragmentation of IoTs or Internet-connected devices is a security nightmare, due to poor security measures implemented by their vendors. Now, the researchers at security firm ESET have a piece of Malware that is targeting embedded devices such as routers, and other connected devices like gateways and wireless access points, rather than computers or smartphones. Dubbed KTN-Remastered or KTN-RM, the malware is a combination of both Tsunami (or Kaiten) as well as Gafgyt. is a well-known IRC ( ) bot used by miscreants for launching Distributed Denial of Service (DDoS) attacks while is used for Telnet scanning. KTN-RM, which researcher dubbed 'Remaiten,' features an improved spreading mechanism by carrying downloader executable binaries for embedded platforms and other connected devices. The malware first performs to look for routers and smart devices. Once the connection is made, the malware tries to guess the login credentials in an effort to take over weakly-secured devices. If it successfully logs in, the malware will issue a shell command to download bot executable files for multiple system architectures before running them on the compromised networking kit. The malware, version 2.0, also has a welcome message for those who might try to neutralise its threat, containing a reference to the Malware Must Die blog. Perhaps it is a way to take revenge, as has published extensive details about Gafgyt, Tsunami and other members of this Malware family. For more technical details about KTN-RM or Remaiten, you can head on to ESET's official published Wednesday.
Researchers have discovered malware that is targeting embedded devices, such as routers, as well as connected devices. It has been dubbed KTN-Remastered (or Distributed Denial of Service ) and is a combination of Gafgyt and Tsunami . The former is used to launch distributed denial of service (DDoS) attacks, while the latter is used for Telnet scanning. The malware first uses Telnet scanning to seek out routers and smart devices. Once a connection is made, it then attempts to guess Tsunami , making weakly-secured devices particularly vulnerable. If successful, the malware issues a shell command to download bot executable files for multiple system architectures. It then runs them on the compromised kit.