lolloj - Fotolia
New Mirai variant attacks Apache Struts vulnerability
New variants of the Gafgyt and Mirai botnets are targeting unpatched enterprise devices, which indicates a greater shift away from consumer devices, according to researchers.
New variants of the Mirai and Gafgyt botnets are targeting unpatched enterprise devices, according to new research.
Palo Alto Networks' Unit 42 found the variants affect vulnerabilities in Apache Struts and in SonicWall's Global Management System (GSM). The Mirai variant exploits the same vulnerability in Apache Struts that was behind the 2018 Equifax data breach, while the Gafgyt variant exploits a newly uncovered vulnerability in unsupported, older versions of SonicWall's GSM.
The Unit 42 research team noted the Mirai variant involves taking advantage of 16 different vulnerabilities. And while that's not unusual, it is the first known instance of Mirai or any of its variants targeting an Apache Struts vulnerability.
The research also found the domain that hosts the Mirai samples had resolved to a different IP address in August, which also hosted Gafgyt samples at that time. Those samples exploited the SonicWall GSM vulnerability, which is tracked as CVE-2018-9866. Unit 42's research did not say whether the two botnets were the work of a single threat group or actor, but it did say the activity could spell trouble for enterprises.
"The incorporation of exploits targeting Apache Struts and SonicWall by these IoT/Linux botnets could indicate a larger movement from consumer device targets to enterprise targets," the Palo Alto researchers wrote.
The Apache Struts vulnerability exploited by the new Mirai variant was patched last year before it was used in the Equifax breach. But systems that have not been updated are still susceptible to these types of exploits.
The Mirai botnet first emerged in the fall of 2016, and it has since affected hundreds of thousands of IoT and connected devices. The botnet's malware had primarily targeted consumer devices, and it was responsible for massive distributed denial-of-service attacks on the German teleco Deutsche Telekom and on the domain name server provider Dyn, which took down websites such as Airbnb, Twitter, PayPal, GitHub, Reddit, Netflix and others.
The Unit 42 researchers discovered the Gafgyt and Mirai variant on Aug. 5, and they alerted SonicWall about its GMS vulnerability. The public disclosure was posted by Palo Alto on Sept. 9.
