#esetresearch — Public Fediverse posts

"⚰️ Mozi Botnet's Mysterious Demise: The Kill Switch Discovery 🕵️‍♂️"

Researchers at ESET have uncovered the kill switch that led to the abrupt downfall of the Mozi botnet, a notorious threat to IoT devices. The botnet's activity plummeted in August 2023, first in India and then in China, as a result of a control payload delivered via UDP, bypassing the BitTorrent DHT protocol. This strategic takedown raises questions about its orchestrators - the botnet creators themselves or Chinese law enforcement. 🤔💡

Tags: #MoziBotnet #KillSwitch #CyberForensics #IoTSecurity #BotnetTakedown #ESETResearch #CyberSecurity #ThreatIntelligence

Credit: Ivan Bešina, Michal Škuta, Miloš Čermák via WeLiveSecurity

For a detailed analysis of the Mozi botnet's kill switch and its implications, stay tuned to ESET's upcoming publications. Meanwhile, explore the MITRE ATT&CK techniques used:

• Resource Development: Acquiring infrastructure like virtual private servers.
• Initial Access: Exploiting public-facing applications.
• Persistence: Using boot or logon initialization scripts.
• Exfiltration: Sending data over unencrypted protocols.
• Impact: Stopping services and blocking access with iptables.

🔐 MITRE ATT&CK - Mozi

#ESETresearch discovered a #backdoor we have named Sponsor, used in a #BallisticBobcat (aka Charming Kitten, #TA453, #APT35, or #PHOSPHORUS) campaign targeting various entities in Brazil, Israel, and the United Arab Emirates. Check it out: https://welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-bobcats-scan-strike-backdoor/