Mirai Malware Leverages Windows

The Mirai bot that runs on the Linux operating system developed a new way to use Windows to further its malicious aims, security researchers found.

According to Bleeping Computer, researchers from Russian cybersecurity firm Dr. Web found a Windows Trojan designed to help spread the Mirai malware. This is an unusual development since Mirai had previously propagated only from Linux systems.

A New Way to Spread Mirai Malware

Even though the actual Mirai bot will not run on a Windows machine, the Trojan can perform some of the work the bot might otherwise have to do on its own to find its victims. The Windows Trojan amplifies the overall Mirai infection with additional processing power.

The Trojan infects Linux-running machines it discovers with the Mirai bot. If it encounters a Windows system, it inserts the Trojan code instead. Both systems can be infected, just with different payloads.

If the Trojan finds a database to infect, such as MS SQL or MySQL, it will try to create a new user that possesses admin privileges. Such a user could exfiltrate the information in that database, putting valuable information directly in the hands of the cybercriminal.

A Brute-Force Attack on the Internet

The classic Mirai botnet starts its quest for worldwide domination by selecting a random IP address. It then attempts to log into that IP address via the Telnet or SSH port using a list of default admin credentials.

In many ways, Mirai’s propagation method alone is a brute-force attack on the internet. The malware authors experience no downside to their incessant pinging of IP addresses — it only enables them to identify more potential victims. This is where the Windows Trojan comes in: It can check IP addresses for the bot and return any positive results to the malware’s command-and-control (C&C) servers for final instructions.

Additionally, Windows version of Mirai uses different ports than the Linux version to self-propagate. It can use ports 22 (Telnet), 23 (SSH), 135 (DCE/RPC), 445 (Active Directory), 1433 (MSSQL), 3306 (MySQL) and 3389 (RDP) in its effort to reproduce, Bleeping Computer noted.

Dr. Web researchers only found the Trojan in the last month, which means security professionals must be on high alert.

Larry Loeb

Principal, PBC Enterprises

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

A New Way to Spread Mirai Malware

A Brute-Force Attack on the Internet

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates