{"id":18647,"date":"2022-04-01T07:40:03","date_gmt":"2022-04-01T15:40:03","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/04\/01\/news-12380\/"},"modified":"2022-04-01T07:40:03","modified_gmt":"2022-04-01T15:40:03","slug":"news-12380","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/04\/01\/news-12380\/","title":{"rendered":"Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Research<\/b><\/h2>\n

Affected Platforms:<\/b> Linux
Impacted Users: <\/b>Any organization
Impact: <\/b>Remote attackers gain control of the vulnerable systems
Severity Level: <\/b>Critical<\/p>\n

Between February and March 2022, our FortiGuard Labs team observed that the Beastmode (aka B3astmode) Mirai-based DDoS campaign has aggressively updated its arsenal of exploits. Five new exploits were added within a month, with three targeting various models of TOTOLINK routers.<\/p>\n

This inclusion of TOTOLINK exploits is especially noteworthy as they were added just a week after the exploit codes were published on GitHub. We previously reported on the MANGA campaign<\/a>, which similarly adopted exploit code within weeks of their release.<\/p>\n

By rapidly adopting newly released exploit code, threat actors can potentially infect vulnerable devices and expand their botnets before patches are applied to fix these vulnerabilities.<\/p>\n

TOTOLINK has already released updated firmware<\/a> for affected models and users are strongly encouraged to update their devices.<\/p>\n

This post details how this threat leverages these vulnerabilities to control affected devices, and ways to protect users from these attacks.<\/u><\/p>\n

Exploiting New Vulnerabilities<\/b><\/h2>\n

The Beastmode campaign derives its name from filenames and URLs used for its binary samples (Figure 1), as well as a unique HTTP User-Agent header "b3astmode" (Figure 2) within the exploit requests. Binary samples are based on the publicly available source code of the Mirai botnet.<\/p>\n<\/p><\/div>\n