Mirai Variant MooBot Botnet Targets Vulnerable D-Link Devices

Security researchers at Palo Alto Networks Unit42 have detected that vulnerable D-Link devices are targeted in MooBot Botnet campaigns, which are known to be the Mirai Botnet variant.

In observed exploit attempts, threat actors exploit the following security vulnerabilities to propagate MooBot to network devices running Linux and with internet exposure;

• CVE-2015-2051: D-Link HNAP SOAPAction Header Command Execution Vulnerability (Version 2.0)
• CVE-2018-6530: D-Link SOAP Interface Remote Code Execution Vulnerability (Version 3.0)
• CVE-2022-26258: D-Link Remote Command Execution Vulnerability (Version 3.0)
• CVE-2022-28958: D-Link Remote Command Execution Vulnerability (Version 3.0)

Threat actors exploit these vulnerabilities to breach the security of devices and then use these devices as bots in various attacks, such as distributed denial of service (DDoS) targeting different systems.

D-Link has released security updates regarding the specified security vulnerabilities, but still, many users are known to be running un-updated older versions or vulnerable devices. Therefore, in order not to be the target of similar malware attacks that may be carried out, users using vulnerable D-Link versions are recommended to apply updates that fix the vulnerabilities immediately. In addition, it is important to prevent the IOC findings related to the campaign in question from the security solutions in use.