{"id":1722,"date":"2025-01-30T01:04:30","date_gmt":"2025-01-30T01:04:30","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=1722"},"modified":"2025-01-30T01:04:30","modified_gmt":"2025-01-30T01:04:30","slug":"new-mirai-botnet-fires-off-ddos-attacks-via-compromised-mitel-phones-notifies-command-control-when-detected","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=1722","title":{"rendered":"New Mirai botnet fires off DDoS attacks via compromised Mitel phones, notifies command & control when detected"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A third variant of the Mirai-based Aquabot malware is apparently taking over Mitel phones to create a remote-controlled botnet that can fire off distributed denial of service (DDoS<\/a>) attacks.\u00a0<\/p>\n

Dubbed Aquabotv3, the malware is actively exploiting a known vulnerability in the devices to\u00a0 access their session initiation protocol (SIP) function, according to Akamai\u2019s Security Intelligence and Response Team<\/a>.<\/p>\n

Interestingly, this variant has a unique, never-before-seen (at least in Mirai<\/a>) characteristic: It reports when it\u2019s detected. Akamai\u2019s team says the malware \u201cexhibits a behavior we have never before seen with Mirai\u201d: Its [report_kill<\/em>] function alerts its command-and-control server (C2) when the infected device attempts to terminate the malware. However, the researchers said they had not yet seen a response from the C2.<\/p>\n

\u201cDDoS continues to be a pervasive threat to many organizations, and botnets such as Aquabot are key players in this,\u201d Akamai security researchers Kyle Lefton and Larry Cashdollar wrote in a blog post<\/a>. \u201cThe ROI of Mirai for an aspiring botnet author is high. Mirai is one of the most successful botnet families in the world, and is also one of the more simple ones to modify.\u201d<\/p>\n

A unique characteristic \u2014 but that\u2019s not necessarily an advantage<\/h2>\n

The Mirai botnet was designed to hijack Internet of Things (IoT) devices to create remote control botnets that can launch high volume DDoS attacks. Aquabot was first discovered in November 2023 by antivirus vendor Antiy Labs.<\/p>\n

Aquabotv3 exploits a command injection vulnerability, CVE-2024-41710<\/a>, that specifically targets the Mitel 6800, 6900 and 6900w series phones. First disclosed in mid-July 2024, the vulnerability allows attackers to gain administrative privileges and tamper with input parameters to gain access to sensitive data. This can allow them to execute arbitrary system-specific commands.<\/p>\n

\u201cThese IoT machines often lack proper security features, are at the end of service, or are left with default configurations and passwords either from neglect or lack of knowledge about the dangers,\u201d Lefton and Cashdollar wrote.<\/p>\n

They noted that, at first glance, the malware appears to be just a \u201cstandard Mirai malware binary with typical DDoS attack functions.\u201d However, when looking closer, they discovered a function that sends a signal when it detects certain security actions in the infected device that could terminate the malware. When any are identified, Aquabotv3 catches them, flags the malware as \u201cdefended\u201d against that signal, then reports back to its C2.<\/p>\n

\u201cWe haven\u2019t seen this behavior before in a Mirai variant, so perhaps it may become a new feature,\u201d the researchers wrote.<\/p>\n

The true reason for this behavior is not yet confirmed, but it could be a way for the author to monitor the botnet\u2019s health. Another reason could be intentional observation of a device\u2019s defensive activity so attackers can develop \u201cmore stealthy variants.\u201d Or, it could also be used to detect active competing botnets or ethical takedown campaigns.<\/p>\n

\u201cUnique, however, is not always the most useful \u2014 this malware was not particularly quiet, which could be to its detriment,\u201d Lefton and Cashdollar emphasized.<\/p>\n

The ongoing fight against Mirai-based DDoS attacks<\/h2>\n

There is an untold number of Mirai variants \u2014 researchers have put them at anywhere from just seven to more than 200 \u2014 but cybersecurity companies are being diligent in rooting them out.<\/p>\n

Just a week ago, for instance, Cloudflare said that it had detected the biggest DDoS ever recorded, a 5.6 terabits per second (Tbps) attack launched by a Mirai variant. It was directed at an Asian internet service provider (ISP) and originated from more than 13,000 IoT devices. It lasted only 80 seconds and was quickly identified and mitigated by Cloudflare\u2019s autonomous systems.<\/p>\n

\u201cIt required no human intervention, didn\u2019t trigger any alerts, and didn\u2019t cause any performance degradation,\u201d Cloudflare wrote in a blog last week<\/a>.<\/p>\n

In another case<\/a>, researchers from VulnCheck found that attackers have been using the Gayfemboy botnet<\/a>, based on Mirai malware, since November 2024 to attack previously unknown vulnerabilities in routers and smart home devices.<\/p>\n

Clearly, Mirai isn\u2019t going away anytime soon, if ever, nor are DDoS attacks. In fact, Cloudflare reported a 53% increase<\/a> in DDoS threats in 2024 over 2023 and a whopping 1,885% surge in attacks exceeding 1 Tbps, dubbed \u201chyper-volumetric\u201d DDoS attacks, between the third and fourth quarters of 2024.<\/p>\n

Aquabot advertised as DDoS-as-a-service<\/h2>\n

Akamai\u2019s researchers found that Aquabotv3\u2019s creators have been advertising the botnet as DDoS as a service through platforms including Telegram, under different names including Cursinq Firewall, The Eye Services, and The Eye Botnet.<\/p>\n

They pointed out that threat actors commonly assert that the botnet is not harmful, and only intended for DDoS mitigation testing purposes (or red teaming). \u201cThreat actors will claim it\u2019s just a proof of concept (PoC) or something educational, but a deeper analysis shows that they are in fact advertising DDoS as a service, or the owners are boasting about running their own botnet,\u201d Lefton and Cashdollar wrote.<\/p>\n

In any case, the researchers underscored the importance of securing IoT devices that are still configured with default credentials. Because many botnets rely on common password libraries for authentication, it\u2019s important to check login credentials and change them if they are still set to default or are easy to guess. Also, security teams should identify where known IoT devices are, and \u201ccheck for rogue ones, too.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A third variant of the Mirai-based Aquabot malware is apparently taking over Mitel phones to create a remote-controlled botnet that can fire off distributed denial of service (DDoS) attacks.\u00a0 Dubbed Aquabotv3, the malware is actively exploiting a known vulnerability in the devices to\u00a0 access their session initiation protocol (SIP) function, according to Akamai\u2019s Security Intelligence […]<\/p>\n","protected":false},"author":0,"featured_media":1708,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1722","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1722"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1722"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1722\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/1708"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}