The source code for dangerous malware containing more than 30 exploits for various routers and IoT devices has been published on GitHub, putting millions of devices at risk. According to experts, open access to the code could increase the number of attacks, as attackers will be able to use it directly or create new variants of viruses based on it.
In November last year, AT&T Alien Labs discovered BotenaGo malware written in Golang. This virus allows attackers to execute remote commands on infected devices. Among the vulnerabilities exploited by BotenaGo are devices from D-Link, Netgear, Linksys, and Tenda.
Alien Labs’ research has shown that BotenaGo receives commands for attacks in two ways. In one case, two backdoor ports are installed to obtain the target’s IP address, and in the other, a listener is launched to intercept data via system input/output. Initially, BotenaGo did not have a C&C (Command and Control) infrastructure, but a new variation of the virus is already designed to work with a C&C server.
The URLs of the BotenaGo payload match those used by the Mirai botnet, leading researchers to believe that Mirai attackers are using BotenaGo to attack known vulnerable devices. Despite its compact size (only 2,981 lines of code), the virus contains more than 30 exploits for routers and IoT devices.
Among them:
- CVE-2020-9377 – D-Link DIR-610;
- CVE-2018-10561, CVE-2018-10562 – GPON home routers;
- CVE-2020-10987 – Tenda AC15 AC1900 (version 15.03.05.19);
- CVE-2020-9054 – ZyXEL NAS with firmware 5.2;
- CVE-2017-6077, CVE-2017-6334 – NETGEAR DGN2200 with firmware up to 10.0.0.50.
In addition, BotenaGo’s detection rate is extremely low: out of 60 antivirus engines, only three were able to detect the latest samples at the time of discovery.