Mirai Variant Adds Dozen New Exploits to Target Enterprise IoT Devices

Although the original creators of Mirai
botnet have already been arrested and
jailed, variants of the infamous IoT malware, including Satori and
Okiru, keep
emerging due to the availability of its source code on
the Internet since 2016.
^{[3][4][5][6][7]}

First emerged in 2016, Mirai^[8] is well known IoT botnet
malware that has the ability to infect routers, and security
cameras, DVRs, and other smart devices—which typically use default
credentials and run outdated versions of Linux—and enslaves the
compromised devices to form a botnet, which is then used to conduct DDoS
attacks^[9].

New Mirai Variant Targets Enterprise IoT Devices

Now, Palo Alto Network Unit 42 researchers have spotted the newest
variant of Mirai that’s for the first time targeting
enterprise-focused devices, including WePresent WiPG-1000 Wireless
Presentation systems and LG Supersign TVs.

The Mirai variant adds 11 new exploits to its “multi-exploit
battery,” making it a total of 27 exploits, as well as a new set of
“unusual default credentials” to use in brute force attacks against
Internet-connected devices.

Besides these two exploits, the new Mirai variant is also
targeting various embedded hardware like:

• Linksys routers
• ZTE routers
• DLink routers
• Network Storage Devices
• NVRs and IP cameras

After scanning and identifying vulnerable devices, the malware
fetches the new Mirai payload from a compromised website and
downloads it on a target device, which is then added to the botnet
network and eventually can be used to launch HTTP Flood DDoS
attacks.
Mirai is the infamous botnet that was responsible for some of the
record-breaking DDoS attacks, including those against France-based
hosting provider
OVH^[11] and Dyn DNS
service^[12] that crippled some
of the world’s biggest
sites^[13], including Twitter,
Netflix, Amazon, and Spotify.

Mirai-based
attacks^[14] experienced sudden rise
after someone publicly released its source
code^[15] in October 2016,
allowing attackers to upgrade the malware threat with newly
disclosed exploits according to their needs and targets.