An updated Gafgyt variant is found attempting to infect IoT devices; specifically small office/home wireless routers of known commercial brands like Zyxel, Huawei, and Realtek. The variant uses remote code execution exploits to gain access and recruit routers into botnets to attack gaming servers – most notably those running the Valve Source engine – and cause a Denial of Service (DoS). This variant also competes against similar botnets, which are frequently sold on Instagram. According to Shodan scans, there are more than 32,000 WiFi routers potentially vulnerable to these exploits around the world. Following flaws are being exploited to drop this variant.
CVE-2017-18368 – ZYXEL P660HN-T1A
CVE-2017-17215 – Huawei HG532
CVE-2014-8361 – Realtek RTL81XX Chipset
It uses three “scanners” that attempt to exploit known remote code execution vulnerabilities present on the routers mentioned above. These scanners replace the typical dictionary attack commonly found in other IoT botnets.
The exploits were crafted to work as binary droppers, which pull the corresponding binary from a malicious server depending on the type of device it is trying to infect.
Once the malware is running on a compromised device, it connects to a C2 server, which is the same as the binary dropper server, and sends the device information to join the botnet. Once the device joins the botnet, it starts receiving commands to perform various types of DoS attacks.