Microsoft explains Zerobot malware’s new features

January 4, 2023 - TuxCare PR Team

The Zerobot malware discussed in this blog post is unrelated to ZeroBot.ai, a GPT-3.5-powered verbal chatbot that shares the same name, and is also unrelated to the ZeroBot Raspberry Pi Zero 3D printed video streaming robot, which also shares the same name

According to Microsoft, Zerobot, a one-of-a-kind botnet written in Go and distributed via IoT and web application vulnerabilities, has added new features and infection mechanisms.

Zerobot, according to FortiGuard Labs, contains several modules, including self-replication, attacks for various protocols, and self-propagation. It also uses the WebSocket protocol to communicate with its command-and-control server.

Microsoft says the malware has reached version 1.1 and is capable of exploiting flaws in Apache and Apache Spark to compromise various endpoints and then use them in attacks. It tagged the flaws used to deploy Zerobot as CVE-2021-42013 and CVE-2022-33891. It also mentioned that the ability to target vulnerabilities in MiniDVBLinux DVR systems, Grandstream networking systems, and the Roxy-WI GUI is one of the features.

Microsoft explains that once on the device, Zerobot injects a malicious payload that then attempts to download several binaries in order to identify the architecture by brute force. Depending on the operating system, the botnet employs a variety of persistence mechanisms to maintain access to infected devices.

“The malware may attempt to gain device access by using a combination of eight common usernames and 130 passwords for IoT devices over SSH and telnet on ports 23 and 2323 to spread to devices,” Microsoft wrote, adding that efforts to access ports and combine with them using port-knocking on ports 80, 8080, 8888, and 2323 have also been made.

It also has additional distributed denial-of-service attack capabilities, such as functions that allow threat actors to target and disable resources. Zerobot DDOS attacks that are successful can be used to extort ransom payments, distract from other malicious activity, or disrupt operations.

According to Microsoft, these capabilities enable threat actors to target various resources and render them inaccessible. According to the report, the destination port is customizable in almost every attack, allowing threat actors who purchase the malware to modify the attack as they see fit.

The sources for this piece include an article in SecurityAffairs.

Summary