Satori IoT Botnet Variant

---

Abstract

On June 15, Radware’s deception network detected an upsurge of malicious activity scanning and infecting a variety of IoT devices to take advantage of recently discovered device exploits. The payload, previously unseen, is deliv-ered by the infamous Satori botnet, this time leveraging a worm style propagation manner. Radware observed an exponential increase in the number of attack sources spread all over the world and peaking at over 2500 attackers in a 24-hour period.

Figure 1: D-Link exploitation attempts

Satori is a Mirai-based botnet, first discovered by security researches from Qihoo 360 Netlab, who also provided an in-depth analysis of this new Satori Variant in their June 15th post. The new variant is infecting D-Link DSL-2750B rout-ers as well as scanning for vulnerable XionMai uc-httpd 1.0.0 devices, which has caused a surge in port scanning activities (ports 80, 8000, 8080). This Satori variant also carries DDoS capabilities and has been reported to launch several DDoS attacks.

Background

Radware’s Threat Research team witnessed thousands of IPs trying to infect our honeypots at a high rate, using a previously unseen payload.

Figure 2: Distribution of infections by country

Figure 3: Exponential increase in attack sources on June 16

Attack Methods

This attack exploits an RCE (Remote Code Execution) vulnerability of the D-Link DSL-2750B router, causing it to launch a wget command for downloading a remote script hosted on a web server at 185.62.190.191.

Figure 4: Downloading a remote script from the C2

Figure 5: Content of the download script hosted at hxxp://185.62.190.191/r

Figure 6: Full exploit body, including the 'Hello world' User-Agent

At the time of writing, no CVE exists for this D-Link vulnerability even though it was disclosed over two years ago (see table below).

 

Denial of Service

As Satori originated from the Mirai botnet, it features some of its original attack libraries and includes the following vectors, each that can be triggered at infected IoT devices simultaneously.

• UDP Flood
• SYN Flood
• TCP_ACK Flood
• GRE Flood

During the time of writing this document, the original download server (185.62.190.191) was taken down. After less than a day, new variants started to hit our honeypots, downloading updated binaries from 95.215.62.169 - the same server used as Satori C2. We have reported and uploaded the binaries.

Figure 7: VirusTotal detection of new Satori variants

Figure 8: Content of new download script hosted at hxxp://95.215.62.169/r

IOCs / Hashes

Mitigation Recommendations

Only a threat intelligence service that monitors active threats and can provide actionable information in real time. Radware’s ERT Active Attackers Feed automatically correlates and qualifies discoveries based on information from Radware’s global detection network and feeds Radware’s application and network security devices with this intelligence for automated blocking of the known attackers. In addition, the Security Update Service (SUS) makes sure customers will have signature to such known vulnerabilities.

Effective DDoS Protection Essentials

• Hybrid DDoS Protection - On-premise and cloud DDoS protection for real-time DDoS attack prevention that also addresses high volume attacks and protects from pipe saturation
• Behavioral-Based Detection - Quickly and accurately identify and block anomalies while allowing legitimate traffic through
• Real-Time Signature Creation - Promptly protect from unknown threats and zero-day attacks
• A Cyber-Security Emergency Response Plan - A dedicated emergency team of experts who have experience with Internet of Things security and handling IoT outbreaks
• Intelligence on Active Threat Actors – high fidelity, correlated and analyzed date for preemptive protection against currently active known attackers.

For further network and application protection measures, Radware urges companies to inspect and patch their network in order to defend against risks and threats.

Under Attack and in Need of Expert Emergency Assistance? Radware Can Help

Radware offers a service to help respond to security emergencies, neutralize the risk and better safeguard operations before irreparable damages occur. If you’re under DDoS attack or malware outbreak and in need of emergency assistance, contact us with the code "Red Button."