The source code of a dangerous strain of malware that encompasses more than 30 exploits for various routers and IOT devices has recently surfaced on Github, placing millions of devices at risk.
Security experts say that releasing the code on Github could lead to an increase in cyberattacks, as threat actors could easily use it in their own attack campaigns or create new malware strains based on it.
AT&T Alien Labs first spotted the malware, called BotenaGo, last November. The malware, written in Google’s Golang (Go) open-source programming language, can help attackers execute remote shell commands on compromised systems.
BotenaGo hosts more than 30 vulnerability exploits for vendors such as D-Link, Netgear, Linksys and Tenda. The malware receives commands for targeting victims in two different ways, an Alien Labs analysis shows.
In one scenario, the malware creates two backdoor ports to listen and receive the target’s IP address, while the other involves deploying a listener to the system I/O input and using it to receive target intel.
Upon discovery, researchers pointed out that, although the malware can receive commands remotely, it lacks a command and control (C&C) infrastructure. However, things seem to have changed, as one new BotenaGo variant is designed to use a C&C server, according to an Alien Labs report.
Reportedly, BotenaGo’s payload links were similar to those used by Mirai botnet malware operators, which led researchers to believe that Mirai threat actors use BotenaGo to target known, vulnerable devices.
Despite its light frame (only 2,981 lines of code), the newly discovered malware packs a serious punch, considering that it hosts more than 30 vulnerability exploits for router and IOT devices. These include, but are not limited to:
Last but not least, the malware also has a low detection rate; at the time of the discovery, only three of 60 antivirus engines were reportedly able to detect new BotenaGo samples.
Vlad's love for technology and writing created rich soil for his interest in cybersecurity to sprout into a full-on passion. Before becoming a Security Analyst, he covered tech and security topics.View all posts
May 16, 2023
March 10, 2023
June 06, 2023