home.social

#mirai — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #mirai, aggregated by home.social.

  1. DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

    An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

    Pulse ID: 69f25f09e5c3a33611f7cb16
    Pulse Link: otx.alienvault.com/pulse/69f25
    Pulse Author: AlienVault
    Created: 2026-04-29 19:42:01

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

  2. Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

    Nexcorium is a multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to build a botnet for distributed denial-of-service attacks. The campaign, attributed to Nexus Team based on custom HTTP headers, uses OS command injection to deliver malware across ARM, MIPS, and x86-64 architectures. The malware implements multiple persistence mechanisms including init configuration, startup scripts, systemd services, and cron jobs. It features XOR-encoded configurations, self-integrity checks, and self-replication capabilities. Attack capabilities include UDP flood, TCP SYN flood, TCP ACK flood, and VSE query flood among others. The botnet spreads through brute-force attacks using default credentials and exploits CVE-2017-17215 targeting Huawei HG532 devices, demonstrating typical IoT-focused botnet characteristics.

    Pulse ID: 69e2824d25c0dbc3e1de156b
    Pulse Link: otx.alienvault.com/pulse/69e28
    Pulse Author: AlienVault
    Created: 2026-04-17 18:56:13

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ELF #GRIT #HTTP #ICS #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #RCE #SMS #TCP #UDP #Vulnerability #bot #botnet #AlienVault

  3. Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

    Nexcorium is a multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to build a botnet for distributed denial-of-service attacks. The campaign, attributed to Nexus Team based on custom HTTP headers, uses OS command injection to deliver malware across ARM, MIPS, and x86-64 architectures. The malware implements multiple persistence mechanisms including init configuration, startup scripts, systemd services, and cron jobs. It features XOR-encoded configurations, self-integrity checks, and self-replication capabilities. Attack capabilities include UDP flood, TCP SYN flood, TCP ACK flood, and VSE query flood among others. The botnet spreads through brute-force attacks using default credentials and exploits CVE-2017-17215 targeting Huawei HG532 devices, demonstrating typical IoT-focused botnet characteristics.

    Pulse ID: 69e2824d25c0dbc3e1de156b
    Pulse Link: otx.alienvault.com/pulse/69e28
    Pulse Author: AlienVault
    Created: 2026-04-17 18:56:13

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ELF #GRIT #HTTP #ICS #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #RCE #SMS #TCP #UDP #Vulnerability #bot #botnet #AlienVault

  4. Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

    Nexcorium is a multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to build a botnet for distributed denial-of-service attacks. The campaign, attributed to Nexus Team based on custom HTTP headers, uses OS command injection to deliver malware across ARM, MIPS, and x86-64 architectures. The malware implements multiple persistence mechanisms including init configuration, startup scripts, systemd services, and cron jobs. It features XOR-encoded configurations, self-integrity checks, and self-replication capabilities. Attack capabilities include UDP flood, TCP SYN flood, TCP ACK flood, and VSE query flood among others. The botnet spreads through brute-force attacks using default credentials and exploits CVE-2017-17215 targeting Huawei HG532 devices, demonstrating typical IoT-focused botnet characteristics.

    Pulse ID: 69e2824d25c0dbc3e1de156b
    Pulse Link: otx.alienvault.com/pulse/69e28
    Pulse Author: AlienVault
    Created: 2026-04-17 18:56:13

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ELF #GRIT #HTTP #ICS #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #RCE #SMS #TCP #UDP #Vulnerability #bot #botnet #AlienVault

  5. Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

    Nexcorium is a multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to build a botnet for distributed denial-of-service attacks. The campaign, attributed to Nexus Team based on custom HTTP headers, uses OS command injection to deliver malware across ARM, MIPS, and x86-64 architectures. The malware implements multiple persistence mechanisms including init configuration, startup scripts, systemd services, and cron jobs. It features XOR-encoded configurations, self-integrity checks, and self-replication capabilities. Attack capabilities include UDP flood, TCP SYN flood, TCP ACK flood, and VSE query flood among others. The botnet spreads through brute-force attacks using default credentials and exploits CVE-2017-17215 targeting Huawei HG532 devices, demonstrating typical IoT-focused botnet characteristics.

    Pulse ID: 69e2824d25c0dbc3e1de156b
    Pulse Link: otx.alienvault.com/pulse/69e28
    Pulse Author: AlienVault
    Created: 2026-04-17 18:56:13

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ELF #GRIT #HTTP #ICS #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #RCE #SMS #TCP #UDP #Vulnerability #bot #botnet #AlienVault

  6. Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign

    Nexcorium is a multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to build a botnet for distributed denial-of-service attacks. The campaign, attributed to Nexus Team based on custom HTTP headers, uses OS command injection to deliver malware across ARM, MIPS, and x86-64 architectures. The malware implements multiple persistence mechanisms including init configuration, startup scripts, systemd services, and cron jobs. It features XOR-encoded configurations, self-integrity checks, and self-replication capabilities. Attack capabilities include UDP flood, TCP SYN flood, TCP ACK flood, and VSE query flood among others. The botnet spreads through brute-force attacks using default credentials and exploits CVE-2017-17215 targeting Huawei HG532 devices, demonstrating typical IoT-focused botnet characteristics.

    Pulse ID: 69e2824d25c0dbc3e1de156b
    Pulse Link: otx.alienvault.com/pulse/69e28
    Pulse Author: AlienVault
    Created: 2026-04-17 18:56:13

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ELF #GRIT #HTTP #ICS #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #RCE #SMS #TCP #UDP #Vulnerability #bot #botnet #AlienVault

  7. Our 4Q2024 Malware Activity reports are available at cybercrimeinfocenter.org/malwa

    For the TL;DR

    - Malware targeting endpoint devices decreased > 50% over the July - September 2024 reporting period

    - Malicious documents found on Wordpress sites continue to rise

    - Mirai on the rise, Mozi in decline

    - China and India again have the most IPv4 addresses reported for hosting malware

    - We processed more than 1M Traffic Injectors and Attackware reports

    #iot #malware #attackware #wordpress #mirai #mozi

    For a bit more than TL;DR read our Malware Trends for the period at cybercrimeinfocenter.org/malwa

  8. Fortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 fortinet.com/blog/threat-resea

    #CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC