Malware Botnets Actively Exploit Realtek and Cacti Vulnerabilities

March 30, 2023

Multiple malware botnets have been actively targeting Cacti and Realtek vulnerabilities in campaigns detected between January and March 2023, spreading ShellBot and Moobot malware. The targeted flaws are CVE-2021-35394, a critical remote code execution vulnerability in Realtek Jungle SDK, and CVE-2022-46169, a critical command injection flaw in the Cacti fault management monitoring tool. Both vulnerabilities have been exploited by other botnet malware in the past, including Fodcha, RedGoBot, Mirai, Gafgyt, and Mozi.

Fortinet reports that the volume of malicious activity in 2023 is significant, targeting exposed network devices to enlist them in DDoS (distributed denial of service) swarms. While Fortinet's report does not explicitly state if the same threat actors spread Moobot and ShellBot, payloads were observed exploiting the same flaws in overlapping attack bursts.

Moobot, a variant of Mirai, was first discovered in December 2021, targeting Hikvision cameras. In September 2022, it was updated to target multiple D-Link RCE flaws. Currently, it targets CVE-2021-35394 and CVE-2022-46169 to infect vulnerable hosts, then downloads a script containing its configuration and establishes a connection with the C2 server. Moobot continues to exchange heartbeat messages until it recognizes an incoming command, which is when it initiates its attack. A notable feature of new Moobot versions is their ability to scan for and kill processes of other known bots so that they can harvest the maximum hardware power of the infected host to launch DDoS attacks.

ShellBot was first spotted in January 2023 and continues to be active today, primarily targeting the Cacti flaw. Fortinet captured three malware variants, indicating that it is being actively developed. The first variant establishes communication with the C2 and awaits the reception of one of the following commands: The second variant of ShellBot, which first appeared in March 2023 and already counts hundreds of victims, features a much more extensive set of commands, as shown below: Interestingly, the malware features an exploit enhancement module that aggregates news and public advisories from PacketStorm and milw0rm.

The recommended action to defend against Mootbot and ShellBot is to use strong administrator passwords and apply the security updates that fix the mentioned vulnerabilities. If your device is no longer supported by its vendor, it should be replaced with a newer model to receive security updates.

Related News

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.