A new Mirai-based botnet is targeting zero-day vulnerabilities in Tenda routers, according to researchers at 360 Netlab, a unit of Chinese cybersecurity company Qihoo 360.
Dubbed Ttint, the Remote Access Trojan (RAT) contains distributed denial of service capabilities, just as any Mirai offspring does, but also implements 12 remote access functions, including a Socket5 proxy, modifying router DNS and iptables, and running system commands.
In order to circumvent detection of typical traffic generated by Mirai botnets, Ttint uses the WSS (WebSocket over TLS) protocol for communication with the command and control (C&C) server, and also uses encryption.
The botnet’s activity was initially detected in November 2019, when the attackers started abusing the first zero-day vulnerability in Tenda routers (CVE-2020-10987). The second bug started being exploited in August 2020, but 360 Netlab says the vendor has not responded to its emails reporting the flaw.
“We analyzed and compared Ttint samples in the two periods and found that their C2 instructions were exactly the same, but they had some differences in the 0-day vulnerability, XOR Key, and C2 protocol used,” 360 Netlab says.
Ttint, the researchers say, has a relatively simple behavior, where it deletes its own files when running, modifies its process name, manipulates the watchdog, and can prevent device restarts. After establishing a connection to the C&C, it sends device information and starts waiting for instructions.
The malware has many of the features previously observed in Mirai, such as a random process name, encryption of configuration information, support for multiple DDoS attack vectors, or the fact that only a single malware instance is running at a time. However, unlike Mirai, it uses the websocket protocol.
Functions implemented in Ttint allow attackers to remotely access the router’s intranet, hijack network access to possibly steal sensitive information, set traffic forwarding rules, and leverage a reverse shell as a local shell. The malware can also update itself or kill its own process, and can execute commands issued by the C&C.
The threat supports a total of 22 commands, including many for launching DDoS attacks.
Tenda router users are advised to check the firmware on their devices and make sure that available updates are installed if necessary. They should also monitor and block the related IoCs shared by 360 Netlab.
Related: Vulnerabilities Expose Popular DVB-T2 Set-Top Boxes to Botnets: Researchers
Related: FritzFrog Botnet Uses Proprietary P2P Protocol
Related: Developer of DDoS Botnets Based on Mirai Code Sentenced to Prison
