Mirai Variant Botnet Takes Aim at Financials
Criminals, like carpenters, hate to see a good tool go unused. It’s no surprise, then, that the Mirai botnet has been in action once again, this time in concert with other botnets and with targets in the financial sector.
Insikt Group, the threat research group within Recorded Future, found that a Mirai botnet variant was used to attack a company, or companies, in the financial sector in January. And it might not have been alone; they found that it was possibly linked to the IoTroop or Reaper botnet.
Three financial companies were hit by DDoS attacks on Jan. 28: two at the same time, and the third a few hours later. On Jan. 29, ABN Amro, a Dutch bank, reported that they had been hit by a DDoS attack the previous day and that other Dutch banks had also been hit. Insikt Group says that the DNS amplification attack used against one of the first targets hit 30 Gbps – highly disruptive, but not the largest attack seen
A Diverse Crew
According to the researchers, the botnet involved in the first company attack was 80% compromised MikroTik routers and 20% various IoT devices. Those devices range from Apache and IIS web servers to webcams, DVRs, TVs, and routers. Manufacturers of the recruited devices include companies from the very small up to Cisco and Linksys.
Irfan Saif is cyber risk services principal for Deloitte Risk and Financial Advisory. In an interview with Dark Reading he points out that the IoT devices brought into the botnets have processing, communication, and networking capabilities, so it’s not surprising that they’re being recruited for nefarious purposes. “It will be a continuing problem and the intricacies and complexities will continue to evolve,” he says.
“There’s an ever-increasing set [of IoT applications] in industries and for facilities management that will broaden the set of devices that can be taken,” Saif says, adding, “The complexity of devices that can be taken will continue to increase.”
The analysts at Insikt Group say that, while many of the devices used in the attacks were previously available for use in other botnets, many others were not known to be subject to existing botnet malware.
Source | darkreading
