Realtek and Cacti flaws now actively exploited by malware botnets

A number of malware botnets actively goal Cacti and Realtek vulnerabilities in campaigns detected between January and March 2023, spreading ShellBot and Moobot malware.

The focused flaws are CVE-2021-35394, a important distant code execution vulnerability in Realtek Jungle SDK, and CVE-2022-46169, a important command injection flaw within the Cacti fault administration monitoring device.

Each flaws have been exploited by different botnet malware up to now, together with Fodcha, RedGoBot, Mirai, Gafgyt, and Mozi.

Fortinet experiences that the amount of the malicious exercise in 2023 is important, concentrating on uncovered community units to enlist them in DDoS (distributed denial of service) swarms.

Whereas Fortinet’s report doesn’t explicitly state if the identical menace actors unfold Moobot and ShellBot, payloads had been noticed exploiting the identical flaws in overlapping assault bursts.

Moobot infections

Moobot, a variant of Mirai, was first found in December 2021, concentrating on Hikvision cameras. In September 2022, it was updated to focus on a number of D-Hyperlink RCE flaws.

At the moment, it targets CVE-2021-35394 and CVE-2022-46169 to contaminate weak hosts, then downloads a script containing its configuration and establishes a reference to the C2 server.

Moobot continues to trade heartbeat messages till it acknowledges an incoming command, which is when it initiates its assault.

A notable characteristic of recent Moobot variations is their capacity to scan for and kill processes of different recognized bots in order that they will harvest the utmost {hardware} energy of the contaminated host to launch DDoS assaults.

ShellBot assaults

ShellBot was first noticed in January 2023 and continues to be energetic in the present day, primarily concentrating on the Cacti flaw. Fortinet captured three malware variants, indicating that it’s being actively developed.

The primary variant establishes communication with the C2 and awaits the reception of one of many following instructions:

• ps – carry out a port scan on the required goal and port
• nmap – carry out a Nmap port scan on a specified port vary
• rm – delete recordsdata and folders
• model – ship model data
• down – obtain a file
• udp – provoke UDP DDoS assault
• again – inject reverse shell

The second variant of ShellBot, which first appeared in March 2023 and already counts tons of of victims, options a way more intensive set of instructions, as proven beneath:

Curiously, the malware options an exploit enhancement module that aggregates information and public advisories from PacketStorm and milw0rm.

The really helpful motion to defend in opposition to Mootbot and ShellBot is to make use of robust administrator passwords and apply the safety updates that repair the talked about vulnerabilities.

In case your gadget is not supported by its vendor, it ought to be changed with a more moderen mannequin to obtain safety updates.