Bitdefender has discovered a new IoT botnet, Dark Nexus, which is used to carry out DDoS attacks.
The botnet spreads by carrying out credential padding attacks against an extensive range of IoT devices, including routers, video recorders, and thermal cameras.
“The scanner is implemented as a finite state machine modeling the Telnet protocol and the subsequent infection steps, in which the attacker issues commands adaptively based on the output of previous commands,” discovered Bitdefender.
The name Dark Nexus stems from the strings printed on the botnet banner, with researchers highlighting that notwithstanding some botnet features are genuine, its code can be similar to the Mirai and Qbot ones.
Currently composed of at least 1,372 infected devices, Dark nexus appeared in the threat scene earlier this year, acting as a reverse proxy.
“While it might share some features with previously known IoT botnets, the way some of its modules have been developed makes it significantly more potent and robust,” reads a press release shared by the security firm. “For example, payloads are compiled for 12 different CPU architectures and dynamically delivered based on the victim’s configuration.”
“The startup code of the bot resembles that of Qbot: it forks several times, blocks several signals, and detaches itself from the terminal,” continues Bitdefender.
“Then, in the vein of Mirai, it binds to a fixed port (7630), ensuring that a single instance of this bot can run on the device. The bot attempts to disguise itself by changing its name to ‘/bin/busybox.’ Another feature borrowed from Mirai is the disabling of the watchdog by periodic ioctl calls on the virtual device.”
Experts examined the C2 infrastructure that comprises numerous servers; once a brute-force attack succeeds, the bot registers to the C2 server providing details about the device. In return, it receives a custom payload via Telnet.
Specialists observed that some versions of the Dark Nexus botnet (4.0 to 5.3) implement a reverse proxy feature to allow the victim to act as a proxy for the hosting server.
“Using YouTube videos demoing some of his past work and posting offerings on various cybercriminal forums, greek.Helios seems to have experience with IoT malware skills, honing them to the point of developing the new dark_nexus botnet,” Bitdefender concluded.