Fortinet has recently discovered a malware called Moobot, which was widely distributed through a security vulnerability in a number of Hikvision surveillance or security cameras. Moobot is a variant of the well-known botnet malware Mirai.
When a victim device is infected, it turns the device into a member of its botnet army, accepts instructions from the threat actors, and launches Distributed Denial of Service (DDoS) attacks against specific targets.
Infection Process
Moobot exploited a vulnerability CVE-2021-36260 in the webserver of Hikvision’s various surveillance cameras to invade.
A specially crafted message of malicious commands sent to Hikvision devices with this vulnerability, that can yield this vulnerability and inject malicious code for infection.
According to the Fortinet report, The method of attacking Hikvision products is very simple, and it does not even need to pass any login verification procedures, as long as a special attack message is sent to the target device to succeed.
After Moobot got infected, it modify some common commands, such as the “reboot” command used to restart the device, so that the administrator cannot restart the hacked device.
Apart from this, the Moobot features several common elements of Satori, it’s also a variant of Mirai botnet, and in the summer of 2020, the author of Satori got arrested.
Here are the similarities of Moobot with Satori:-
- Using a separate downloader.
- The forking of the “/usr/sbin*” process.
- Overwriting the legitimate “macHelper” file with the Moobot executable.
Floods used
Incorporating the compromised device into a DDoS swarm is the primary goal of Moobot, and in this proceeding to attack the C2 sends several floods with the target IP address and port number.
Here are the floods used by Moobot:-
- UDP flood
- ACK flood
- ACK+PUSH flood
- SYN flood
However, the vulnerability CVE-2021-36260 has been already fixed in the new version of Hikvision’s firmware launched in September 2021.
But, here, most IoT product owners will hardly update the product, in short, there are still a large number of unpatched products that will be there on the market, which will make it a perfect target for hackers.
