Beastmode Mirai botnet now includes exploits for Totolink routers

Operators behind the Mirai-based distributed denial-of-service (DDoS) botnet Beastmode (aka B3astmode) added exploits for Totolink routers.

The Mirai-based distributed denial-of-service (DDoS) botnet Beastmode (aka B3astmode) now includes exploits for Totolink routers. Like most DDOS botnets, Beastmode attempt to infect other devices by launching brute-forcing attacks or exploiting multiple vulnerabilities.

Between February and March 2022, researchers from the FortiGuard Labs team observed Beastmode operators adding five new exploits in a few weeks, with three targeting some TOTOLINK routers.

The threat actors added TOTOLINK exploits just a week after the exploit codes were publicly released on GitHub in the attempt to compromise the largest number of devices as possible before the owners upgrade to the latest firmware releases.

TOTOLINK has already addressed these flaws with the release of new firmware for vulnerable devices.

Below is the list of the vulnerabilities in Totolink devices exploited by the Beastmode botnet analyzed by Fortinet:

CVE-2022-26210 targets TOTOLINK A800R, A810R, A830R, A950RG, A3000RU, and A3100R.CVE-2022-26186 targets TOTOLINK N600R and A7100RU.CVE-2022-25075/25076/25077/25078/25079/25080/25081/25082/25083/25084 are a family of similar vulnerabilities targeting TOTOLINK A810R, A830R, A860R, A950RG, A3100R, A3600R, T6, and T10 routers.

The Beastmode botnet also includes exploits for the following issues:

CVE-2021-45382 targets D-Link products (DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L and DIR-836L)CVE-2021-4045 targets TP-Link Tapo C200 IP camera.CVE-2017-17215 targets Huawei HG532 routers.CVE-2016-5674 targets NUUO NVRmini2, NVRsolo, Crystal Devices, and NETGEAR ReadyNAS Surveillance products.

Once devices are infected by the Beastmode bot, the botnet can perform a variety of DDoS attacks, including:

attack_app_httpattack_tcp_ackattack_tcp_synattack_udp_plainattack_udp_vseattack_udp_ovhhexattack_udp_stdhexattack_udp_CLAMP

“Even though the original Mirai author was arrested in fall 2018, this article highlights how threat actors, such as those behind the Beastmode campaign, continue to rapidly incorporate newly published exploit code to infect unpatched devices using the Mirai malware.” concludes the report. “By continuously monitoring the evolving threat landscape, FortiGuard Labs researchers identify new vulnerabilities exploited by Mirai variants and malware targeting IoT devices to bring greater awareness to such threats and better secure our customers’ networks.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Beastmode botnet)