It has been observed that a newly surfaced malware botnet named "Zerobot" written in Google's open-source programming language Golang, is targeting vulnerabilities in the variety of devices including application delivery services, firewalls, routers and DVR/cameras etc. Zerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device, downloads script named "zero," which could allow itself to self-propagate. The malware is at modification phase and has been recently updated with string obfuscation, copy file module and propagation exploit module that make it harder to detect and gives it a higher capability to infect more devices. It may allow remote attackers to gain access of vulnerable systems and its Anti-Kill module prevents victims from disrupting the Zerobot program.
Infection Mechanism: The new Golang-based malware botnet is designed to target a wide range of CPU architectures such as i386, amd64, arm, arm64, mips, mips64, mips64le, mipsle, ppc64, ppc64le, riscv64, and s390x. Zerobot targets several vulnerabilities to gain access to a device and then downloads a script for further propagation. Zerobot gets its name from a propagation script that"s used to retrieve the malicious payload after gaining access to a host depending on its microarchitecture implementation (e.g., "zero.arm64").
Zerobot, upon initialization in the compromised machine, establishes contact with a remote command-and-control (C2) server and awaits further instructions that allow it to run arbitrary commands and launch DDoS attacks for different network protocols like TCP, UDP, TLS, HTTP, and ICMP. Zerobot includes 21 exploits. In addition to some IoT vulnerabilities, it includes Spring4Shell, phpAdmin, F5 Big, etc., to increase its success rate. The malware also uses an "anti-kill" module designed to prevent terminating or killing its process.
Zerobot, upon initialization in the compromised machine, establishes contact with a remote command-and-control (C2) server and awaits further instructions that allow it to run arbitrary commands and launch DDoS attacks for different network protocols like TCP, UDP, TLS, HTTP, and ICMP. Zerobot includes 21 exploits. In addition to some IoT vulnerabilities, it includes Spring4Shell, phpAdmin, F5 Big, etc., to increase its success rate. The malware also uses an "anti-kill" module designed to prevent terminating or killing its process.
Zerobot uses the following exploits to breach its targets:
- CVE-2014-08361: miniigd SOAP service in Realtek SDK
- CVE-2017-17106: Zivif PR115-204-P-RS webcams
- CVE-2017-17215: Huawei HG523 router
- CVE-2018-12613: phpMyAdmin
- CVE-2020-10987: Tenda AC15 AC1900 router
- CVE-2020-25506: D-Link DNS-320 NAS
- CVE-2021-35395: Realtek Jungle SDK
- CVE-2021-36260: Hikvision product
- CVE-2021-46422: Telesquare SDT-CW3B1 router
- CVE-2022-01388: F5 BIG-IP
- CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)
- CVE-2022-25075: TOTOLink A3000RU router
- CVE-2022-26186: TOTOLink N600R router
- CVE-2022-26210: TOTOLink A830R router
- CVE-2022-30525: Zyxel USG Flex 100(W) firewall
- CVE-2022-34538: MEGApix IP cameras
- CVE-2022-37061: FLIX AX8 thermal sensor cameras
Indicators of InfectionHashes:
C2:
176[.]65[.]137[.]5
Files:
- 7ae80111746efa1444c6e687ea5608f33ea0e95d75b3c5071e358c4cccc9a6fc
- df76ab8411ccca9f44d91301dc2f364217e4a5e4004597a261cf964a0cd09722
- cd9bd2a6b3678b61f10bb6415fb37ea6b9934b9ec8bb15c39c543fd32e9be7bb
- 50d6c5351c6476ea53e3c0d850de47059db3827b9c4a6ab4d083dfffcbde3579
- 7722abfb3c8d498eb473188c43db8abb812a3b87d786c9e8099774a320eaed39
- 2955dc2aec431e5db18ce8e20f2de565c6c1fb4779e73d38224437ac6a48a564
- 191ce97483781a2ea6325f5ffe092a0e975d612b4e1394ead683577f7857592f
- 447f9ed6698f46d55d4671a30cf42303e0bd63fe8d09d14c730c5627f173174d
- e0766dcad977a0d8d0e6f3f58254b98098d6a97766ddac30b97d11c1c341f005