Two years have passed since the emergence of Mozi, and the botnet still continues to spread.
360 Netlab discovered the Mozi botnet in 2019. In two years, it became a massive operation that handled a high percentage of the Internet of Things’ traffic at its peak.
According to Netlab, Mozi has infected over 1.5 million nodes and the majority of them are from China.
The Mozi is a P2P botnet and it uses DHT protocol. Its operators use weak Telnet passwords and known exploits when targeting various internet-connected devices. The botnet is used to launch denial-of-service attacks on victims’ devices. It can also steal data and execute system commands, and if routers are compromised, this could lead to Man-in-The-Middle (MITM) attacks.
Mozi has evolved its persistence mechanisms to adapt to the architecture of each device’s hardware, usually those manufactured by Netgear, Huawei, and ZTE.
In July, security firm Netlab claimed that it assisted law enforcers in the arrest of the alleged developer of the Mozi botnet. Despite the arrest, the botnet is still being used.
“We know that Mozi uses a P2P network structure, and one of the “advantages” of a P2P network is that it is robust, so even if some of the nodes go down, the whole network will carry on, and the remaining nodes will still infect other vulnerable devices,” Netlab says. “That is why we can still see Mozi spreading.”
The Netlab team says the fact that the botnet uses P2P setup — Mozi_ssh — and the Mozi_ftp protocol tells that the botnet is also used to carry out illegal activities, such as cryptocurrency mining.
The team also mentioned that users are creating new functional nodes for the botnet’s DHT configuration module. The Netlab team says this allows its operators to “quickly develop the programs needed for new functional nodes, which is very convenient.
“This convenience is one of the reasons for the rapid expansion of the Mozi botnet,” Netlab added.
Netlab predicts that the size of the botnet will slowly decrease over the next few weeks, but the impact of Mozi will still be felt for some time.
