IoTroop

Check Point Researchers have discovered a brand new Botnet, dubbed ‘IoTroop’, evolving and recruiting IoT devices at a far greater pace and with more potential damage than the Mirai botnet of 2016.

As sending the malicious code to each device individually would be a large and time consuming task, it is much easier to have each infected device spreading the malicious code to other similar devices themselves. This method of attack is considered a propagation attack.

Unlike Mirai — which wriggles into vulnerable IoT devices using factory-default or hard-coded usernames and passwords — this newest IoT threat leverages at least nine known security vulnerabilities across nearly a dozen different device makers.

What was found on this device, however, was an edited version with a ‘Netcat’ command which opened a reverse shell to the attack’s IP.

So far we estimate over a million organizations have already been scanned worldwide, including the US, Australia and everywhere in between, and the number is only increasing.

As sending the malicious code to each device individually would be a large and time consuming task, it is much easier to have each infected device spreading the malicious code to other similar devices themselves. This method of attack is considered a propagation attack.

A global network of millions of hacked IoT devices can be used for a variety of purposes — such as serving as a sort of distributed proxy or anonymity network...

This tells us that this machine was merely one link in the chain and that it was both infected and then also transmitting the infection.

What was found on this device, however, was an edited version with a ‘Netcat’ command which opened a reverse shell to the attack’s IP.

Researchers can’t say for certain what IoTroop will be used for but it is based at least in part on Mirai, which was made to launch distributed denial of service (DDoS) attacks.