A huge wave of attacks is targeting home routers in South Africa for recruitment into a Hakai-based botnet.

A new malware campaign is attempting to build a bigger botnet, and it's raising warning flags for its attack vector — and the location of the victims.

According to NetScout, IoT honeypots run by its ATLAS Security Engineering & Response Team (ASERT) saw, from April 22 to May 10, a 5,043% increase of exploit attempts that originated in Egypt and targeted consumer routers in South Africa. The attacks, with a payload that attempted to recruit the routers into a botnet using a Hakai DDoS bot variant, exploit (CVE-2014-8361) a remote command execution exploit in the Realtek SDK managed SOAP service.

According to Rich Hummel, threat research manager for NetScout ASERT, these consumer routers are almost never patched or updated, with many consumers having no idea that a management interface exists, or how to use it. And unfortunately, "There are a lot of different factors here, and there are different layers, but it's really on the consumer or owner of the devices to protect themselves against the threats," Hummel says.

Asked about a possible motivation for this attack, at this time, Hummel says that ASERT can only speculate about any "deep" motivation. The most logical answer, though, is that someone simply decided to spin up a new botnet.

"This is a target of opportunity," Hummel says. "These attacks are automated, so it could be that something was seen and an automated attack was launched." As for what was seen, Hummel says that it could have been something as simple as a Shodan script looking for exposed devices with an automated attack script aimed at the results file.

Attack automation and malware as a service make botnet creation something that's available to just about anyone, Hummel says. "It can be done on a Raspberry Pi."

For more, read here.

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights