Trellix Details Masjesu DDoS Botnet’s IoT Infection and Evasion Techniques
Summary
Trellix details Masjesu, an IoT botnet active since at least 2023. It spreads by scanning for vulnerable devices, uses process masquerading and cron jobs for persistence, and supports multiple DDoS attack types.
Key points
- Trellix says Masjesu has been active since at least 2023 and targets IoT devices across multiple architectures.
- It spreads by scanning random internet IP addresses for devices vulnerable to flaws in routers, gateways, DVRs, and UPnP services.
- For persistence, it renames its executable to resemble a Linux dynamic linker and uses a cron job to run it every 15 minutes.
- The malware encrypts sensitive strings, including command-and-control details, and decrypts them at runtime.
- It can launch multiple DDoS attack types, including UDP, TCP, GRE, RDP, ICMP, and HTTP floods.
- Trellix found most infected devices in Vietnam, with additional devices in Brazil, India, Iran, Kenya, and Ukraine.
Article Details
- Attack Vectors
- Masjesu spreads by scanning random IP addresses for vulnerable IoT devices, including D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, and devices with UPnP services.
- Infected devices are used to launch DDoS attacks, including UDP, TCP, VSE, GRE, RDP, OSPF, ICMP, IGMP, TCP_SYN, TCP-ACK, TCP-ACKPSH, and HTTP floods.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationMasjesu encrypts sensitive strings, including C&C domains, ports, folder names, and process names, in a lookup table and decrypts them at runtime.T1036.005 · Match Legitimate Resource Name or LocationMasjesu renames its executable path to mimic a legitimate Linux dynamic linker and renames its background process to appear as a legitimate system component.T1053.003 · CronMasjesu creates a cron job that runs its renamed executable every 15 minutes for persistence.T1210 · Exploitation of Remote ServicesThe botnet spreads by exploiting vulnerabilities in routers, home gateways, DVRs, UPnP services, and other IoT devices.T1498 · Network Denial of ServiceMasjesu-controlled devices launch DDoS attacks using multiple flood types, including UDP, TCP, ICMP, and HTTP.T1595.002 · Vulnerability ScanningMasjesu scans random IP addresses to find vulnerable devices it can infect.
Malware
Vendors
D-LinkThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.HuaweiThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.MVPowerThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.NETGEARThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.
Products
D-Link routersThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.Huawei home gatewaysThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.MVPower DVRsThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.Netgear routersThe botnet spreads through vulnerabilities in D-Link routers, GPON routers, Huawei home gateways, MVPower DVRs, Netgear routers, UPnP services, and other IoT devices.
Countries
BrazilHowever, the botnet has also infected numerous devices in Brazil, India, Iran, Kenya, and Ukraine.IndiaHowever, the botnet has also infected numerous devices in Brazil, India, Iran, Kenya, and Ukraine.IranHowever, the botnet has also infected numerous devices in Brazil, India, Iran, Kenya, and Ukraine.KenyaHowever, the botnet has also infected numerous devices in Brazil, India, Iran, Kenya, and Ukraine.UkraineHowever, the botnet has also infected numerous devices in Brazil, India, Iran, Kenya, and Ukraine.VietnamMost of the devices ensnared by Masjesu are in Vietnam, an analysis of attack source countries shows.