June 12, 2019 By Shane Schick 2 min read

Researchers discovered a Mirai malware variant with 18 exploits targeting embedded internet of things (IoT) devices, including set-top boxes, smart home controllers and even software-defined wide-area networking equipment.

Samples of the latest version of the botnet virus, which was first discovered in 2016, were initially disclosed in a blog post published by Palo Alto Networks. Researchers suggested that cybercriminals working with the Linux open-source operating system are trying to take over an increasingly wide range of IoT devices and use them to run distributed denial-of-service (DDoS) attacks. Eight of the exploits in the latest Mirai malware variant are new, the researchers added.

What’s Different About the Latest Mirai Malware

While security experts have been studying Mirai for some time, the latest variant contains multiple previously unknown default credentials that could be used in brute-force attacks, according to researchers. A string table that spells 0xDFDAAXFD serves as the encryption key, which echoes the original Mirai source code’s standard encryption scheme.

Much in the way a legitimate software product would be assessed and improved over time, researchers said the threat actors behind Mirai are continuously evaluating the exploits it uses, keeping those that tend to infect more machines. Four of the exploits in the current variation, for example, are designed to take over specific products, such as LG Supersign TV sets and Belkin’s Wemo devices.

Although two different command-and-control (C&C) server domains were identified, they didn’t resolve to any particular IP address, the researchers said. The final iteration of the latest Mirai malware was uploaded on May 26, following some minor updates to the directory hosting it.

Keep IoT Devices Safe From Mirai

Unfortunately, IoT devices are popular with cybercriminals because they often run in environments with little to no human intervention. That means security professionals need to ensure that their networks are only running products that incorporate security by design.

IBM experts suggest the best IoT manufacturers do things like conducting an attack surface analysis to see in which ways devices might be vulnerable to rogue actors, and prioritizing continuous integration and deployment automation based on the highest areas of risk.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today