Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities

Dec 22, 2022Ravie Lakshmanan

The Zerobot DDoS botnet has received
substantial updates that expand on its ability to target more
internet-connected devices and scale its network.

Microsoft Threat Intelligence Center (MSTIC) is tracking the
ongoing threat under the moniker DEV-1061, its designation for
unknown, emerging, or developing activity clusters.

Zerobot, first documented^[1]
by Fortinet FortiGuard Labs earlier this month, is a Go-based
malware that propagates through vulnerabilities in web applications
and IoT devices like firewalls, routers, and cameras.

“The most recent distribution of Zerobot includes additional
capabilities, such as exploiting vulnerabilities in Apache and
Apache Spark (CVE-2021-42013^[2]
and CVE-2022-33891^[3]
respectively), and new DDoS attack capabilities,” Microsoft
researchers said^[4].

Also called ZeroStresser by its operators, the malware is
offered as a DDoS-for-hire service to other criminal actors, with
the botnet advertised on social media by its operators.

Microsoft said that one domain with connections to Zerobot –
zerostresser[.]com – was among the 48 domains^[5]
that were seized by the U.S. Federal Bureau of Investigation (FBI)
this month for offering DDoS attack features to paying
customers.

The latest version of Zerobot spotted by Microsoft not only
targets unpatched and improperly secured devices, but also attempts
to brute-force over SSH and Telnet on ports 23 and 2323 for
spreading to other hosts.

The list of newly added known flaws exploited by Zerobot 1.1 is
as follows –

• CVE-2017-17105^[6] (CVSS score: 9.8) – A
  command injection vulnerability in Zivif PR115-204-P-RS
• CVE-2019-10655^[7] (CVSS score: 9.8) – An
  unauthenticated remote code execution vulnerability in Grandstream
  GAC2500, GXP2200, GVC3202, GXV3275, and GXV3240
• CVE-2020-25223^[8] (CVSS score: 9.8) – A
  remote code execution vulnerability in the WebAdmin of Sophos SG
  UTM
• CVE-2021-42013^[9] (CVSS score: 9.8) – A
  remote code execution vulnerability in Apache HTTP Server
• CVE-2022-31137^[10] (CVSS score: 9.8) – A
  remote code execution vulnerability in Roxy-WI
• CVE-2022-33891^[11] (CVSS score: 8.8) – An
  unauthenticated command injection vulnerability in Apache
  Spark
• ZSL-2022-5717^[12] (CVSS score: N/A) – A
  remote root command injection vulnerability in MiniDVBLinux

Upon successful infection, the attacks chain proceeds to
download a binary named “zero” for a specific CPU architecture that
enables it to self-propagate to more susceptible systems exposed
online.

Additionally, Zerobot is said to proliferate by scanning and
compromising devices with known vulnerabilities that are not
included in the malware executable, such as CVE-2022-30023^[13], a command injection
vulnerability in Tenda GPON AC1200 routers.

Zerobot 1.1 further incorporates seven new DDoS attack methods
by making use of protocols such as UDP, ICMP, and TCP, indicating
“continuous evolution and rapid addition of new capabilities.”

“The shift toward malware as a service in the cyber economy has
industrialized attacks and has made it easier for attackers to
purchase and use malware, establish and maintain access to
compromised networks, and utilize ready-made tools to perform their
attacks,” the tech giant said.