Muhstik Botnet
Mushtik is a Mirai-based worm targeting web applications, Internet-of-Things devices, and Small Office/Home Office networking gear. Once enrolled in its botnet, these systems are used to mine cryptocurrency and perform DDoS attacks.
Summary
Mushtik is a Mirai-based worm targeting web applications, Internet-of-Things devices, and Small Office/Home Office networking gear. Once enrolled in its botnet, these systems are used to mine cryptocurrency and perform DDoS attacks.
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
Linux-based IoT and SOHO networked equipment, including DD-WRT, GPON, and Tomato routers; as well as QNAP NAS devices
Threat details
Introduction
First observed in 2017, Muhstik is a modular worm and associated botnet based on the original Mirai code. It targets a wide variety of web applications including WordPress, Drupal, and WebDAV; Oracle's WebLogic application server; as well an assortment if Internet-of-Things (IoT) and Small Office/Home Office (SOHO) devices.
As with Mirai, Muhstik uses it's botnet to mount sizeable distributed denial-of-service (DDoS) attacks, but it will also install several cryptocurrency miners on affected systems.
Propagation & activities
Muhstik typically gains access to new target systems using a combination of brute-force attacks, default credential reuse, and exploits for known vulnerabilities. If successful, a preliminary control module is then dropped on the affected system.
This module then connects to a command and control (C2) server using the Internet Relay Chat protocol. If a connection is made, the module then downloads several encrypted payloads, each of which contain a scanner for a specific technology or vulnerability (e.g. WordPress, CVE-2018-7600, etc). It then decrypts and deploys these scanners to identify new targets and propagate to them.
Meanwhile, the control module reaches out to a different C2 server to download the XMRig and CGMiner cryptocurrency mining applications and executes them on the target system. This C2 server also sends IP/port combinations for Muhstik to perform DDoS attacks against.
Remediation advice
Affected organisations are encouraged to review the below security advisories and apply any relevant updates if they have not already done so.
The NCSC's free Web Check service can also be used to identify web site vulnerabilities, including outdated Drupal installations.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that the NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Oracle Security Alert Advisory | CVE-2019-2725 https://www.oracle.com/security-alerts/alert-cve-2019-2725.html |
| Patch |
Oracle Critical Patch Update Advisory - October 2017 https://www.oracle.com/security-alerts/cpuoct2017.html#AppendixFMW |
| Patch |
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 https://www.drupal.org/sa-core-2018-002 |
Indicators of compromise
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 18 November 2020 1:39 pm