Tag: DDoS

Enemybot is a new botnet that is conducting DDoS (Distributed Denial of Service) assaults on several routers and websites. It is attacking various routers and websites by leveraging existing vulnerabilities in ARM, BSD, x64, x86, and other architectures. Enemybot was identified by FortiGuard labs in mid-March.

This botnet is mostly based on the source code of Gafgyt, however it has been reported to borrow various modules from Mirai’s original source code. To avoid detection, the Enemybot employs a number of obfuscation techniques and hides Command and control (C2) server on the TOR network. The Enemybot botnet spreads and assaults other IoT devices through a variety of tactics. It attempts to gain access to systems using weak or default credentials by logging into devices with a list of hardcoded username/password combinations. By running shell commands, the bot also attempts to infect misconfigured Android devices that expose the Android Debug Bridge port (5555). Enemybot has been observed infecting Seowon Intech and D-Link routers as well as abusing a previously disclosed iRZ router vulnerability.

The bot leverages a number of known and previously disclosed loopholes, which include: –

• SEOWON INTECH SLC-130 and SLR-120S routers are vulnerable to CVE-2020-17456.
• Earlier D-Link routers were vulnerable to CVE-2018-10823.
• CVE-2022-27226 affects iRZ mobile routers.
• CVE-2022-25075 to 25084 affects TOTOLINK routers, which were formerly used by the Beastmode botnet.
• CVE-2021-41773/CVE-2021-42013 is a vulnerability that affects Apache HTTP servers.
• CVE-2018-20062: This vulnerability affects the ThinkPHP CMS.
• CVE-2017-18368 is a vulnerability that affects Zyxel P660HN routers.
• CVE-2016-6277 is a vulnerability that affects NETGEAR routers.
• CVE-2015-2051 is a vulnerability that affects D-Link routers.
• CVE-2014-9118 is a vulnerability that affects Zhone routers.

Once one of the foregoing problems has been exploited, the bot will use the shell command LDSERVER to download a shell script from a URL that the C2 server will dynamically update. The script then downloads the real Enemybot binary, which is adapted to the target device’s architecture. If the download server goes down, the botnet managers can update the bot clients with a new URL. The bot connects to its C2 server after being placed on a device and waits for new orders.

Enemybot’s Capabilities

Enemybot connects to the C2 server and waits for orders to be executed when a device is infected. Although the majority of the instructions are connected to DDoS assaults, the virus is not just focused on them. Fortinet presents the following set of supported commands: –

1. ADNS: Perform a DNS amplification attack with ADNS.
2. ARK: Stealth survival while launching an attack on the game’s servers.
3. BLACKNURSE — Flood the target with ICMP packets indicating that the destination port is unreachable.
4. DNS – Inundate DNS servers with DNS UDP requests that have been hardcoded.
5. HOLD – Flood the target with TCP connections and keep them alive for a certain amount of time.
6. HTTP — Send a flood of HTTP requests to the destination.
7. JUNK — Flood the destination with non-zero-byte UDP packets at random intervals.
8. OVH – Send custom UDP packets to OVH servers.
9. STD — Send a flood of random-byte UDP packets to the destination.
10. TCP — Send a flood of TCP packets to the target with forged source headers.
11. TLS — Carry out an SSL/TLS attack.
12. UDP — Send UDP packets with forged source headers to the destination.
13. OVERTCP — Use randomized packet delivery intervals to launch a TCP assault.
14. STOP — Put an end to continuous DoS assaults.
15. LDSERVER – Update the exploit payload download server.
16. SCANNER — SSH/Telnet brute-force attacks and vulnerabilities spread to additional devices.
17. TCPOFF/TCPON — Turn the sniffer off or on at ports 80, 21, 25, 666, 1337, and 8080, potentially to gather credentials.

Preventing Botnet Attacks

Always apply the latest available software and firmware updates for your product to prevent Enemybot or any other botnet from infecting your devices and recruiting them to malicious DDoS botnets.

One of the most common signs that your router may be infected with a botnet malware infection is that the router may become non-responsive, internet speeds drop, and the router becomes hotter than usual. In such a scenario, you should restart the router and change the passwords. It is also advised to take services of specialized cyber-security professionals to find and weed out the problem.

Centex Technologies provide state-of-the-art cybersecurity and network security solutions for businesses. To know more, contact Centex Technologies at Killeen (254) 213-4740, Dallas (972) 375-9654, Atlanta (404) 994-5074, and Austin (512) 956-5454.