New Mirai botnet targets industrial routers - Source: www.csoonline.com

Security researchers warn of a new variant of the Mirai botnet. Attackers used it for zero-day exploits on industrial routers.

According to security analysis, the Gayfemboy botnet, based on the notorious Mirai malware, is currently spreading around the world. Researchers from Chainxin X Lab found that cybercriminals have been using the botnet since November 2024 to attack previously unknown vulnerabilities. The botnet’s preferred targets include Four-Faith and Neterbit routers or smart home devices.

Experts from VulnCheck reported at the end of December that a vulnerability in Four-Faith industrial routers (CVE-2024-12856) had been exploited in the wild. The attackers exploited the router’s default credentials to launch a remote command injection.

In addition, the botnet was used for targeted attacks on unknown vulnerabilities in Neterbit routers and Vimar smart home devices. According to Chainxin X Lab, Gayfemboy has exploited over 20 vulnerabilities and weak Telnet credentials to access the devices. It includes a brute-force module for insecure Telnet passwords, uses custom UPX packing with unique signatures, and implements Mirai-based command structures. This allows the attackers to update clients, scan networks, and carry out DDoS attacks.

According to researchers, the botnet has been attacking hundreds of targets every day since its discovery in February 2024. The number of daily active bot IPs is 15,000, most of which are located in China, the US, Russia, Turkey, and Iran. Targets are spread across the world and affect various industries, with the main targets being located in China, the US, Germany, the UK, and Singapore.

According to Chainxin X Lab, the botnet’s DDoS attacks are short-lived (between 10 and 30 seconds), but are high in intensity, with data rates exceeding 100Gbps and capable of disrupting even robust infrastructures.