April 22, 2020 By David Bisson 2 min read

Security researchers observed Moobot and other botnets attempting to exploit a zero-day vulnerability in order to compromise fiber routers.

The Network Security Research Lab at 360 detected Moobot abusing the zero-day vulnerability beginning in late February 2020. The exploit involved two steps at the time of analysis. For it to work, digital attackers needed to leverage another vulnerability along with the zero-day flaw.

Not all threat actors who attempted to exploit the zero-day weakness realized the need for another security flaw. This fact became evident in mid-March when the Gafgyt malware tried using a Netlink GPON router remote command execution vulnerability PoC released by Exploit Database, which matched the vulnerability abused by Moobot a month earlier. Gafgyt conducted an internet-wide scan using the exploit, but because it did not leverage another vulnerability, the scan mostly failed.

The same thing happened when digital attackers attempted to spread the Fbot botnet using the flaw. Without the incorporation of another vulnerability, many of the exploit attempts failed.

A Look Back at Moobot’s Recent Activity

Security professionals with the Network Security Research Lab at 360 first came across Moobot back in September 2019. At that time, the team observed the malware using Mirai’s scanning technique to scour the internet for vulnerable devices. It was just a few months later when Network 360 reached out to the equipment manufacturer LILIN after observing multiple attack groups exploiting zero-day vulnerabilities in its DVRs to spread Moobot and other botnets.

How to Defend Against Zero-Day Vulnerabilities

Infosec personnel can help defend their organizations against zero-day vulnerabilities by checking for firmware updates that affect their routers. This process will likely involve registering their devices and signing up for email alerts. Companies should also consider deploying tools that use artificial intelligence (AI) for the purpose of detecting malicious behaviors, such as attempted exploitation of flaws that have yet to be publicly disclosed.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today