Moobot Botnet

Moobot is a botnet which targets IoT devices by exploiting Tenda routers with remote code execution (RCE) vulnerabilities.

Threat ID:: CC-3887
Category:: Botnet, Worm
Threat Severity:: Low
Published:: 17 June 2021 2:06 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Moobot is a botnet which targets IoT devices by exploiting Tenda routers with remote code execution (RCE) vulnerabilities.

Affected platforms

The following platforms are known to be affected:

SOHO and IoT devices

Threat details

Introduction

First observed in April 2020, Moobot is a botnet, targeting Small Office Home Office (SOHO) and Internet-of-Things (IoT) devices. Moobot has been linked with the underground malware domain known as Cyberium, which has also previously been used with Mirai variants.

Delivery and Activities

Moobot is delivered by scanning for insecure Tenda routers that have a remote code execution (RCE) vulnerability. It scans for additional vulnerabilities in the following devices; Axis SSI, Huawei home routers and the Realtek SDK Miniigd.

Moobot uses a command and control (C2) infrastructure hosted by dns.cyberium[.]cc to download additional files. Each of the campaigns use its own different subdomain to divert attention from the dns.cyberium[.]cc domain, so that it is more difficult to track.

Having successfully compromised a device, a request is made to the Cyberium-operated subdomain, to download a bash script which acts as a downloader. This will attempt to download a list of files for the host architecture and execute each file. To achieve persistence, it also creates a crontab scheduled service to redownload a bash script, finally deleting itself.

Remediation advice

To prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Network indicators

Domains

Bot.bigbots[.]cc
Bot.fewbots[.]cc
Cnc.bigbots[.]cc
Cnc1.bigbots[.]cc
Cnc.fewbots[.]cc
Cnc.hardbotz[.]cc
Dns.cyberium[.]cc
Ddns.cyberium[.]cc
Ftp.cyberium[.]cc
Gcc.cyberium[.]cc
Hh.cyberium[.]cc
Hoon.cyberium[.]cc
Life.zerobytes[.]cc
Ns.cyberium[.]cc
Park.allcheesedout[.]cc
Park.cyberium[.]cc
Projectaliennet[.]cc
Ratatouille.allcheesedout[.]cc
Snoopy.cyberium[.]cc
Tmp.cyberium[.]cc
U.cyberium[.]cc
W.cyberium[.]cc
Watchdog.allcheesedout[.]cc
Wo.cyberium[.]cc
Y.cyberium[.]cc

Ports

Port 80 and 8080: Axis SSI RCE
Port 34567: DVR scanner attempting default credentials for Sofia main video application
Port 37215: Huawei Home routers RCE Vulnerability
Port 52869: Realtek SDK Miniigd UPnP SOAP Command Execution