Xlab-Qianxin Unveils Mirai.TBOT: A Dangerous Evolution of Mirai Botnet

The Mirai botnet first emerged in 2016, a formidable threat in the digital landscape. It infiltrated the Internet of Things (IoT) by exploiting weak passwords and vulnerabilities in devices. Once a device succumbed to this malware, it became a part of a vast network controlled by attackers, primarily used for large-scale Distributed Denial of Service (DDoS) attacks.

Recently, security researchers from xlab-qianxin detected Mirai.TBOT, a variant of the original Mirai, operates with distinct characteristics. It organizes infected bots into over 100 groups based on the method of infection or device type. This organization allows attackers to manage and control their network more effectively. The botnet is notable for its:

• 0day Capability: Ability to exploit previously unknown vulnerabilities.
• Custom Domain Usage: Utilizing OpenNIC custom domains for Command and Control (C2) servers.
• Massive Scale: As of November 2023, Mirai.TBOT has an active daily count of over 30,000 bot IPs.

Mirai.TBOT retained much of the original Mirai’s code, with identical operational logic and network protocols. Notably, it conducts Telnet scans and executes commands like ‘/bin/busybox hostname TBOT’, marking its territory. Attack commands are cleverly embedded and diversified, targeting a range of IoT devices.

The botnet uses a range of vulnerabilities for infection, including two confirmed 0 days and several undisclosed exploits. Its method of infection is sophisticated, involving SSH/Telnet weak password exploitation and leveraging known vulnerabilities in routers, gateways, DVRs, and more. The specific vulnerability list is as follows:

The geographical distribution of the victims of the attack

The global spread of Mirai.TBOT is alarmingly vast, with significant infections in China, Venezuela, India, Korea, Brazil, and Japan. Intriguingly, certain bot groups are exclusively found in specific regions, hinting at a targeted approach to its proliferation.

Mirai.TBOT’s evolution showcases the continuous threat posed by botnets in the ever-expanding IoT domain. Its ability to adapt and exploit emerging vulnerabilities makes it a persistent menace. Organizations and individuals alike must remain vigilant, updating security practices to fend off such advanced cyber threats.

The rise of Mirai.TBOT from its Mirai roots reflects the dynamic and hazardous nature of cybersecurity threats in the modern world. As we embrace more connected devices, the shadow of such botnets looms large, prompting a need for robust, proactive defense mechanisms in the digital realm. The story of Mirai.TBOT is not just a tale of a cyber threat; it’s a wake-up call to the vulnerabilities inherent in our interconnected world.