Hackers use the Mirai botnet to launch large-scale Distributed Denial of Service (DDoS) attacks by exploiting vulnerable Internet of Things (IoT) devices.
Mirai’s ability to recruit a massive number of compromised devices allows attackers to do the following things to the targeted online services or websites:
Dominate
Disrupt
Cybersecurity researchers at Akamai recently discovered a new Mirai-based botnet, “NoaBot, ” that is actively attacking Linux devices.
Document
@import url('https://fonts.googleapis.com/css2?family=Poppins&display=swap');
@import url('https://fonts.googleapis.com/css2?family=Poppins&family=Roboto&display=swap');
*{
margin: 0; padding: 0;
text-decoration: none;
}
.container{
font-family: roboto, sans-serif;
width: 90%;
border: 1px solid lightgrey;
padding: 20px;
background: linear-gradient(2deg,#E0EAF1 100%,#BBD2E0 100%);
margin: 20px auto ;
border-radius: 40px 10px;
box-shadow: 5px 5px 5px #e2ebff;
}
.container:hover{
box-shadow: 10px 10px 5px #e2ebff;
}
.container .title{
color: #015689;
font-size: 22px;
font-weight: bolder;
}
.container .title{
text-shadow: 1px 1px 1px lightgrey;
}
.container .title:after {
width: 50px;
height: 2px;
content: ' ';
position: absolute;
background-color: #015689;
margin: 20px 8px;
}
.container h2{
line-height: 40px;
margin: 2px 0;
font-weight: bolder;
}
.container a{
color: #170d51;
}
.container p{
font-size: 18px;
line-height: 30px;
}
.container button{
padding: 15px;
background-color: #4469f5;
border-radius: 10px;
border: none;
background-color: #00456e ;
font-size: 16px;
font-weight: bold;
margin-top: 5px;
}
.container button:hover{
box-shadow: 1px 1px 15px #015689;
transition: all 0.2S linear;
}
.container button a{
color: white;
}
hr{
/ display: none; /
}
Free Webinar
Fastrack Compliance: The Path to ZERO-Vulnerability
Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.
Register for Free
Technical Analysis
NoaBot primarily targets Linux IoT devices for DDoS attacks. Mirai botnet was initially identified in 2016, and its source code is publicly available, leading to various variants appearing.
However, NoaBot initially surfaced in early 2023 and is evolving with:-
Obfuscations
C2 changes
Not only that even researchers also noted several incidents of dropping P2PInfect worm samples which link both campaigns.
NoaBot mirrors Mirai’s capabilities but diverges in code. Unlike Mirai’s Telnet-based spreader, NoaBot uses SSH with a unique “hi” connection.
SSH packet with the ‘hi’ string (Source – Akamai) While embedded song lyrics in early samples remain unexplained, the developers of this botnet removed the lyrics in the later versions.
NoaBot alters Mirai by employing a distinct SSH credential dictionary and introducing post-breach functions like:-
Installing backdoors
Spreading to new victims
Unlike Mirai , NoaBot is compiled with uClibc, which helps in altering antivirus detection to SSH scanner or generic trojan signatures, and the following things complicate the reverse engineering:-
Statically compiled
Symbol-stripped
Obfuscates strings
Newer samples introduce command-line arguments, including “noa” for persistence via crontab entry. The “Noa-” prefix in antivirus detections suggests widespread use and the evolution of post-breach operations.
The miner is a self-compiled XMRig variant that extracts configurations before execution. However, instead of using the following things, it introduces code before mining logic:
Command line
Plaintext
The XMRig configuration usually reveals the following things:
Mining pool details
Wallet addresses
Apart from this, the threat actors evade detection by dynamically modifying the command line and encrypting the pool details by communicating with Google’s DNS for domain resolution.
In 2023, 849 source IPs globally attacked honeypots, with a notable hotspot in China contributing to 10% of all attacks.
Global geolocation heatmap of NoaBot attack sources (Source – Akamai) 849 distinct IP addresses hit honeypots in 2023. Their global activity is quite evenly distributed, according to their geolocation data. Given that the software is wormable, it stands to reason that each new victim also becomes an attacker. On the other hand, China is the standout location for all the action.
Recommendations
To secure networks, cybersecurity researchers recommend:
Limit SSH access.
Always use strong passwords.
Do not use any default or used passwords.
Shared malware credential sets on GitHub aid protection.
Monitor the binary names, process names, and cron jobs to detect the malware.
Access IOC CSV files and YARA signatures in the repository.
Test environments with an Infection Monkey configuration.
Employ the cryptojacking plug-in to assess defenses against stronger credentials.
Try Kelltron’s cost-effective penetration testing services to assess and evaluate the security posture of digital systems – Free Demo
The post Mirai-Based NoaBot Launches a DDoS Attack on Linux Devices appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform .
