- Security researchers are observing a new botnet building campaign called Murdoc
- Its attacks target IP cameras and routers
- More than 1,000 devices have been identified as compromised
Cyber security researchers from Qualy’s Threat Research Unit have observed a new large-scale operation exploiting vulnerabilities in IP cameras and routers to build a botnet.
In a technical analysis, Qualys said the attackers mostly exploited CVE-2017-17215 and CVE-2024-7029 and tried to compromise AVTECH IP cameras and Huawei HG532 routers. The botnet is essentially Mirai, although in this case it was dubbed Murdoc.
Qualys said Murdoc demonstrated “enhanced capabilities, exploiting vulnerabilities to compromise devices and establish expansive botnet networks.”
The tenacious Mirai
The campaign most likely started in July 2024 and has so far managed to compromise 1,370 systems. Most of the victims are in Malaysia, Mexico, Thailand, Indonesia and Vietnam.
With a network of Internet-connected devices (bots) under their control, malicious actors can launch Distributed Denial of Service (DDoS) attacks, bringing websites and services down, disrupting operations, and causing financial and reputational damage.
Mirai is a very popular botnet malware. Created by three university students in the US: Paras Jha, Josiah White and Dalton Norman, Mirai gained notoriety in 2016 after orchestrating a large-scale DDoS attack on Dyn that temporarily disrupted major websites including Netflix and Twitter.
The creators released the source code online just before their arrest in 2017. They pleaded guilty to using the botnet for DDoS attacks and other schemes.
While law enforcement continues to target and disrupt the botnet, it has shown great resilience and continues to be active to this day.
Less than two weeks ago, a Mirai variant named ‘gayfemboy’ was found exploiting a flaw in Four-Faith industrial routers. Although clearly derived from Mirai, this new version is very different, exploiting more than 20 vulnerabilities and targeting weak Telnet passwords. Some of the vulnerabilities have never been seen before and have not yet been assigned CVEs. Among them are errors in Neterbit routers and Vimar smart home devices.
