Many years ago, malware known as Mirai was used to corral millions of security cameras and internet of things (IoT) devices into a botnet.
That botnet was then used to launch attacks at a range of companies and it looks like a similar sort of malware has entered the conversation of late.
The malware was discovered by AT&T Alien Labs and has been dubbed BotenaGo. The malware was created using the open-source programming language Golang and it has reportedly seen a 2 000 percent increase in its use in malware.
What is incredibly concerning about this malware is that is able to leverage over 30 exploits to target an attack.
“Some AVs detect these new malware variants using Go as Mirai malware — the payload links do look similar. However, there is a difference between the Mirai malware and the new malware variants using Go, including differences in the language in which it is written and the malware architectures,” writes Ofer Caspi, security researcher at AT&T Alien Labs.
The researcher goes on to say that BotenaGo only targets vulnerable systems, but it isn’t clear how it operates as there are a few oddities present.
This includes the fact that BotenaGo doesn’t communicate actively with a Command and Control server. While the malware can communicate with a server, at present it doesn’t appear to be communicating. Due to this, AT&T’s security team theorises that BotenaGo is part of a malware suite or it’s an evolution of Mirai. The final theory is that BotenaGo is in the beta phase and was leaked accidentally.
The threat landscape for this malware is incredibly concerning. According to AT&T Alien Labs, as many as 1.9 million IoT devices could be at risk of attack. In addition, almost 250 000 broadband routers could be at risk of an attack.
The researchers at the AT&T lab have listed a number of indicators of compromise as well as the exploits that can be used by BotenaGo.
Recommended actions include insuring software is up-to-date, ensuring minimal exposure to the internet on Linux servers and of IoT devices. This tech should be behind a properly configured firewall and IT teams should monitor network traffic and outbound port scans for unreasonable bandwidth usage.
[Image – CC 0 Pixabay]
