

Rewterz Threat Alert – North Korean Trojan: HOPLIGHT
November 1, 2019
Rewterz Threat Alert – Phishing Campaign Targets Precision Engineering Company
November 1, 2019
Rewterz Threat Alert – North Korean Trojan: HOPLIGHT
November 1, 2019
Rewterz Threat Alert – Phishing Campaign Targets Precision Engineering Company
November 1, 2019Severity
Medium
Analysis Summary
An updated Gafgyt variant is found attempting to infect IoT devices; specifically small office/home wireless routers of known commercial brands like Zyxel, Huawei, and Realtek. The variant uses remote code execution exploits to gain access and recruit routers into botnets to attack gaming servers – most notably those running the Valve Source engine – and cause a Denial of Service (DoS). This variant also competes against similar botnets, which are frequently sold on Instagram. According to Shodan scans, there are more than 32,000 WiFi routers potentially vulnerable to these exploits around the world. Following flaws are being exploited to drop this variant.
CVE-2017-18368 – ZYXEL P660HN-T1A
CVE-2017-17215 – Huawei HG532
CVE-2014-8361 – Realtek RTL81XX Chipset
It uses three “scanners” that attempt to exploit known remote code execution vulnerabilities present on the routers mentioned above. These scanners replace the typical dictionary attack commonly found in other IoT botnets.

The exploits were crafted to work as binary droppers, which pull the corresponding binary from a malicious server depending on the type of device it is trying to infect.
Once the malware is running on a compromised device, it connects to a C2 server, which is the same as the binary dropper server, and sends the device information to join the botnet. Once the device joins the botnet, it starts receiving commands to perform various types of DoS attacks.
Impact
- Remote Code Execution
- Unauthorized Access
- Denial of Service
Affected Vendors
- Zyxel
- Huawei
- Realtek
Affected Products
Wireless Routers
Indicators of Compromise
MD5
- fb93601f8d4e0228276edff1c6fe635d
- f1c099d65bf94e009f5e65238caac468
SH256
- 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc
- 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07
SHA1
- 5b0abd3c12611136fa9378ffc0c76d533cd3a385
- b5fe93481949f81ba6b76e22be7165dfeb88a963
Source IP
185.172.110[.]224
URL
- hxxp[:]//185[.]172[.]110[.]224/arm7
- hxxp[:]//185.172.110[.]224[:]993/
- hxxp[:]//185[.]172[.]110[.]224/mips
Remediation
- Block the threat indicators at their respective controls.
- Only use updated versions of wireless routers.