In the ever-evolving landscape of cybersecurity, threats have become more sophisticated, more targeted, and more relentless. Recently, Mjolnir Security found itself in the midst of a complex investigation that echoed the tension and urgency of a Terminator movie. Much like Sarah Connor being pursued by an unstoppable force, ten credit [...]
Mirai (malware) has been around since 2016. It was first identified as a botnet by MalwareMustDie in August of that year and it gained prominent attention when it was used to attack Brian Kreb’s website. Later that year, the source code for the botnet was released and it continues to spread through various iterations.
Brute-force attacks to log in to internet-connected devices is the most preferred method for spreading various Mirai variants, we have identified that the variants are now going for devices with high-bandwidth, low-latency internet connections and higher computing power which now requires new methods for compromise, moving away from smart devices to more powerful Linux-running devices.
Many of the original Mirai features have made their way to existing variants, such as:
But, newer variants have slightly different implementations or add new exploit capabilities to increase the attack surface.
Earlier this year, the Spring4Shell flaw was exploited by Mirai botnet to start a resurgence.
According to Trend Micro researchers, they observed the bad actors weaponizing to run Mirai malware on vulnerable servers in the Singapore region via the Spring4Shell vulnerability, tracked as CVE-2022-22965.
By exploiting the flaw, attackers can download a Mirai sample to the “/tmp” folder in a server and execute it after a permission change to make them executable using “chmod.” Chmod is a command and system call in Unix and Unix-related servers used to change access permissions of file system objects, known as “modes.”
We have been tracking the spread of Mirai botnet globally and have noticed a spike that doesn’t show signs of slowing down. This is a breakdown of the spread we have seen since the beginning of the year:
You can watch live updates on the botnet through our dashboard here:
Anubis first appeared on Russian hacking forums in 2016, shared as an open-source banking trojan with instructions on implementing its client and components. In the years that followed, Anubis received ...
Bridging the Security Gap with Tailored Compliance Solutions In today’s high-stakes business environment, safeguarding your organization’s assets and reputation is paramount. Mjolnir Security’s GAP Assessment service is specifically designed for executive leaders who recognize the critical importance of robust cybersecurity and compliance. Our service offers a comprehensive evaluation of your current security measures against industry-leading ...
