Researchers discovered a new Go-based botnet called Zerobot that exploits two dozen security vulnerabilities IoT devices.

Fortinet FortiGuard Labs researchers have discovered a new Go-based botnet called Zerobot that spreads by exploiting two dozen security vulnerabilities in the internet of things (IoT) devices and other applications.

“This botnet, known as Zerobot, contains several modules, including self-replication, attacks for different protocols, and self-propagation.” reads the advisory published by Fortinet. “It also communicates with its command-and-control server using the WebSocket protocol. Based on some IPS signatures trigger count, this campaign started its distribution of the current version sometime after mid-November.

Zerobot targets multiple architectures, including i386, amd64, arm, arm64, mips, mips64, mips64le, mipsle, ppc64, ppc64le, riscv64, and s390x. The bot is saved using the filename “zero.”

The malware first appeared in the wild on November 18, 2022 targeting devices running on Linux operating system.

The researchers discovered two versions of the bot, the first employed in attacks before November 24 that only supports basic functions. The current version includes a “selfRepo” module to spread infecting more endpoints with different protocols or vulnerabilities.

Zerobot botnet

Once infected the system, the bot contacts the remote command-and-control (C2) server and awaits further instructions.

Below is the list of supported commands:

Command Detail
ping Heartbeat, maintaining the connection
attack Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP
stop Stop attack
update Install update and restart Zerobot
enable_scan Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker
disable_scan Disable scanning
command Running OS command, cmd on Windows and bash on Linux
kill Kill botnet program

“Within a very short time, it was updated with string obfuscation, a copy file module, and a propagation exploit module that make it harder to detect and gives it a higher capability to infect more devices.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zerobot)


Source link