Mirai Variant MooBot Targets RCE Vulnerabilities in D-Link Routers

MooBot botnet is back for new attacks. The variant of the Mirai malware started a new campaign last month to exploit critical vulnerabilities (CVSS 9.8) in D-Link routers.

MooBot was first identified in December 2021, when it exploits a vulnerability in Hikvision cameras to spread across many devices to build itself a DDoS army. The malware has changed targets, now targeting vulnerable D-Link routers.

Which Vulnerabilities Does MooBot Exploit?

MooBot exploits several old and new vulnerabilities to hack into the routers:

CVE-2022-26258 and CVE-2022-28958 are remote code execution vulnerabilities found in D-Link routers. The vulnerabilities are exploited by writing unknown input in place of “value” and “Device Name” in /lan.asp and shareport.php files.

The botnet malware also exploits old vulnerabilities. CVE-2018-6530 exists in soap.cgi and allows a remote attacker to inject commands into OS. CVE-2018-6530 is discovered to exist in a series of configurations within D-link routers. The oldest exploited vulnerability in the MooBot campaign is CVE-2015-2051, which lets an attacker execute arbitrary commands and is exploited through GetDeviceSettings in the HNAP interface.

The most recent attack of MooBot (Source: Unit 42)

Following the malware’s decoding of the configuration’s hardcoded address, the newly captured routers are registered on the threat actor’s C2 server. The C2 addresses listed in Unit 42’s report and those in Fortinet’s analysis are different, which is significant because it suggests that the threat actor’s infrastructure has been updated.

Depending on the objectives of MooBot’s operators, the captured routers participate in targeted DDoS attacks against different targets.

The power of the botnet is rented to anyone interested in disrupting websites and online services since threat actors typically sell DDoS services to others.

Internet speed drops, slowness, overheated routers, and mysterious DNS configuration changes are indicators of botnet infections and may be experienced by users of hacked D-Link equipment.

Recommendations

The easiest approach to prevent MooBot and other botnet attacks is to update your D-Link router’s firmware whenever an update becomes available.

D-Link has issued security firmware updates to fix the mentioned vulnerabilities.

To block remote access to the admin panel, you should configure any outdated or unsupported hardware you use.

Suppose you believe you may have already been compromised. In that case, you should reset the device using the associated physical button, change your admin password and install the most recent vendor security updates.