Pierluigi Paganini August 07, 2019

The operators behind the recently discovered Echobot botnet added tens of new exploits to infect a broad range of systems worldwide.

In June, experts at PaloAlto Networks uncovered a new botnet, dubbed Echobot that is based on the dreaded Mirai botnet. At the time of its discovery, operators added 8 new exploits, but a few weeks later the popular expert Larry Cashdollar from Akamai’s Security Intelligence Response Team (SIRT) discovered a variant that included a total of 26 exploits. Now the operators behind the Echobot botnet added tens of new exploits to infect a broad range of systems worldwide.

Most of the exploits allow the botnet to compromise unpatched IoT devices, but experts warn that enterprise apps Oracle WebLogic and VMware SD-Wan are also potential targets.

The latest Echobot variant was spotted by security researcher Carlos Brendel Alcañiz, it includes 59 different RCE exploits to propagate.

The exploits could allow operators to target network-attached storage devices (NAS), IP cameras, IP phones, network video recorders (NVR), routers and wireless presentation systems.

Larry Cashdollar explained that even if he has yet to detect a variant of the botnet including over than 50 exploits, he is not surprised.

Brendell discovered the new variant after receiving weaponized code that targeted security flaws in Asus devices, he compiled an published on Pastebin a list of payloads.

“The interesting part is that the author seems to have thrown in exploits without targeting a specific category of products. The code incorporated  is available from multiple public exploit repositories.” reported BleepingComputer.

“Brendel provided BleepingComputer with the exploits he found in this Echobot variant and the products they target include an odd mix of hardware and software solutions: routers, cameras, smart home hubs, network-attached storage systems, servers, database management software, Zeroshell distribution.”

The exploits used by this Echobot variant come from public repositories, below the list shared by the expert:

Pierluigi Paganini

(SecurityAffairs – Echobot variant, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]