Mirai Variant MooBot Botnet Exploiting D-Link Router Vulnerabilities

A variant of the Mirai botnet known as MooBot is co-opting
vulnerable D-Link devices into an army of denial-of-service bots by
taking advantage of multiple exploits.

“If the devices are compromised, they will be fully controlled
by attackers, who could utilize those devices to conduct further
attacks such as distributed denial-of-service (DDoS) attacks,” Palo
Alto Networks Unit 42 said^[1]
in a Tuesday report.

MooBot, first disclosed by Qihoo 360’s Netlab team in September
2019, has previously targeted LILIN digital video recorders^[2] and Hikvision video surveillance
products^[3] to expand its
network.

In the latest wave of attacks discovered by Unit 42 in early
August 2022, as many as four different flaws in D-Link devices,
both old and new, have paved the way for the deployment of MooBot
samples. These include –

• CVE-2015-2051^[4] (CVSS score: 10.0) –
  D-Link HNAP SOAPAction Header Command Execution Vulnerability
• CVE-2018-6530^[5] (CVSS score: 9.8) –
  D-Link SOAP Interface Remote Code Execution Vulnerability
• CVE-2022-26258^[6] (CVSS score: 9.8) –
  D-Link Remote Command Execution Vulnerability, and
• CVE-2022-28958^[7] (CVSS score: 9.8) –
  D-Link Remote Command Execution Vulnerability

Successful exploitation of the aforementioned flaws could lead
to remote code execution and the retrieval of a MooBot payload from
a remote host, which then parses instructions from a
command-and-control (C2) server to launch a DDoS attack on a
specific IP address and port number.

Customers of D-Link appliances are highly recommended to apply
patches and upgrades released by the company to mitigate potential
threats.

“The vulnerabilities […] have low attack complexity but
critical security impact that can lead to remote code execution,”
the researchers said. “Once the attacker gains control in this
manner, they could take advantage by including the newly
compromised devices into their botnet to conduct further attacks
such as DDoS.”