The Mirai bot that runs on the Linux operating system developed a new way to use Windows to further its malicious aims, security researchers found.

According to Bleeping Computer, researchers from Russian cybersecurity firm Dr. Web found a Windows Trojan designed to help spread the Mirai malware. This is an unusual development since Mirai had previously propagated only from Linux systems.

A New Way to Spread Mirai Malware

Even though the actual Mirai bot will not run on a Windows machine, the Trojan can perform some of the work the bot might otherwise have to do on its own to find its victims. The Windows Trojan amplifies the overall Mirai infection with additional processing power.

The Trojan infects Linux-running machines it discovers with the Mirai bot. If it encounters a Windows system, it inserts the Trojan code instead. Both systems can be infected, just with different payloads.

If the Trojan finds a database to infect, such as MS SQL or MySQL, it will try to create a new user that possesses admin privileges. Such a user could exfiltrate the information in that database, putting valuable information directly in the hands of the cybercriminal.

A Brute-Force Attack on the Internet

The classic Mirai botnet starts its quest for worldwide domination by selecting a random IP address. It then attempts to log into that IP address via the Telnet or SSH port using a list of default admin credentials.

In many ways, Mirai’s propagation method alone is a brute-force attack on the internet. The malware authors experience no downside to their incessant pinging of IP addresses — it only enables them to identify more potential victims. This is where the Windows Trojan comes in: It can check IP addresses for the bot and return any positive results to the malware’s command-and-control (C&C) servers for final instructions.

Additionally, Windows version of Mirai uses different ports than the Linux version to self-propagate. It can use ports 22 (Telnet), 23 (SSH), 135 (DCE/RPC), 445 (Active Directory), 1433 (MSSQL), 3306 (MySQL) and 3389 (RDP) in its effort to reproduce, Bleeping Computer noted.

Dr. Web researchers only found the Trojan in the last month, which means security professionals must be on high alert.