APT28, also known as Fancy Bear, has returned with a global espionage campaign that security researchers have dubbed “RoundPress.” Operating under the Russian GRU’s cyber unit (often linked to military intelligence), APT28 has a long history of high-impact intrusions — from the 2016 U.S. election interference to attacks on NATO [...]
Mirai (malware) has been around since 2016. It was first identified as a botnet by MalwareMustDie in August of that year and it gained prominent attention when it was used to attack Brian Kreb’s website. Later that year, the source code for the botnet was released and it continues to spread through various iterations.
Brute-force attacks to log in to internet-connected devices is the most preferred method for spreading various Mirai variants, we have identified that the variants are now going for devices with high-bandwidth, low-latency internet connections and higher computing power which now requires new methods for compromise, moving away from smart devices to more powerful Linux-running devices.
Many of the original Mirai features have made their way to existing variants, such as:
But, newer variants have slightly different implementations or add new exploit capabilities to increase the attack surface.
Earlier this year, the Spring4Shell flaw was exploited by Mirai botnet to start a resurgence.
According to Trend Micro researchers, they observed the bad actors weaponizing to run Mirai malware on vulnerable servers in the Singapore region via the Spring4Shell vulnerability, tracked as CVE-2022-22965.
By exploiting the flaw, attackers can download a Mirai sample to the “/tmp” folder in a server and execute it after a permission change to make them executable using “chmod.” Chmod is a command and system call in Unix and Unix-related servers used to change access permissions of file system objects, known as “modes.”
We have been tracking the spread of Mirai botnet globally and have noticed a spike that doesn’t show signs of slowing down. This is a breakdown of the spread we have seen since the beginning of the year:
You can watch live updates on the botnet through our dashboard here:
Anubis first appeared on Russian hacking forums in 2016, shared as an open-source banking trojan with instructions on implementing its client and components. In the years that followed, Anubis received ...