{"id":25517,"date":"2022-12-23T02:44:28","date_gmt":"2022-12-23T02:44:28","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/23\/zerobot-botnet-upgrade-targets-unpatched-apache-servers\/"},"modified":"2022-12-23T02:44:28","modified_gmt":"2022-12-23T02:44:28","slug":"zerobot-botnet-upgrade-targets-unpatched-apache-servers","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/23\/zerobot-botnet-upgrade-targets-unpatched-apache-servers\/","title":{"rendered":"Zerobot botnet upgrade targets unpatched Apache servers"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Zerobot, an \u201cinternet of things\u201d botnet discovered earlier this year, has been updated with additional features, including the ability to target vulnerabilities on unpatched Apache servers.<\/p>\n

As detailed<\/a>\u00a0Wednesday by researchers at Microsoft Corp.\u2019s Security Threat Intelligence team, Zerobot is a Go-based botnet that primarily spreads through IoT and web application vulnerabilities. Zerobot is offered as part of a malware-as-a-service scheme. One domain with links to the bot was seized by the U.S. Federal Bureau of Investigation on Dec. 14<\/a>.<\/p>\n

The new version, dubbed Zerobot 1.1, has increased capabilities, including new attack methods and exploits for support architectures, expanding its reach to different types of devices, Apache servers notable among them.<\/p>\n

Zerobot 1.1 targets vulnerabilities in Apache and Apache Spark,\u00a0CVE-2021-42013<\/a> and CVE-2022-33891,<\/a> respectively. Added features include the ability to target vulnerabilities in the\u00a0MiniDVBLinux DVR systems, Grandstream networking systems and Roxy-WI GUI.<\/p>\n

Upon gaining device access, Zerobot injects a malicious payload that then attempts to download several binaries to identify the architecture by brute force. Depending on the operating system, the botnet has various persistence mechanisms that are used to maintain access to infected devices. It\u2019s noted that although Zerobot is unable to spread on Windows machines, several examples can run on Windows.<\/p>\n

The new version of Zerobot also has additional distributed denial-of-service attack capabilities, including functions that allow the threat actors to target resources and make them inaccessible. Successful Zerobot DDOS attacks can be used to extort ransom payments, distract from other malicious activity, or disrupt operations.<\/p>\n

\u201cZerobot (and other methods of forming botnet armies) is about as serious as it gets.\u201d\u00a0Bud Broomhead, chief executive officer at IoT cyber hygiene company Viakoo Inc.<\/a>, told SiliconANGLE. \u201cThreat actors gain not just one foothold in your network but thousands of them when IoT and operational-technology devices are infected.\u201d<\/p>\n

Broomhead noted that the number of DDoS attacks is increasing in size, frequency and duration thanks to the spread of bots such as Zerobot that have mainly been unchecked.<\/p>\n

\u201cThreat actors will always go to where defenses are weakest and the potential for exploits is highest \u2013 and that\u2019s exactly what IoT and OT devices offer today,\u201d Broomhead explained. \u201cMany cyber defenses rely on agent-based technology to protect IT systems. IoT\/OT devices can\u2019t accept agents, making IT-oriented solutions ineffective in stopping threats like Zerobot.\u201d<\/p>\n

Broomhead recommends that security teams should at least be using an agentless asset discovery solution so they know what assets can be compromised. Security teams should monitor devices for changes in how they function, such as increased network traffic from them, use of onboard memory, or unusual CPU usage. In addition, security teams need to stay on top of IoT\/OT device firmware updates and password rotations by using an automated and agentless IoT security platform.<\/p>\n

Image: Needpix<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n