New malware targets IoT devices and routers

Researchers have discovered malware that is targeting embedded devices, such as routers, as well as connected devices. It has been dubbed KTN-Remastered (or KTN-RM) and is a combination of Tsunami and Gafgyt. The former is used to launch distributed denial of service (DDoS) attacks, while the latter is used for Telnet scanning. The malware first uses Telnet scanning to seek out routers and smart devices. Once a connection is made, it then attempts to guess login credentials, making weakly-secured devices particularly vulnerable. If successful, the malware issues a shell command to download bot executable files for multiple system architectures. It then runs them on the compromised kit.

Anything connected to the Internet could be hacked and so is the Internet of Things (IoTs)





The market fragmentation of IoTs or Internet-connected devices is a security nightmare, due to poor security measures implemented by their vendors.





Now, the researchers at security firm ESET have discovered a piece of Malware that is targeting embedded devices such as routers, and other connected devices like gateways and wireless access points, rather than computers or smartphones.





Dubbed KTN-Remastered or KTN-RM, the malware is a combination of both Tsunami (or Kaiten) as well as Gafgyt.





Internet Relay Chat) bot used by miscreants for launching Distributed Denial of Service (DDoS) attacks while Gafgyt is used for Telnet scanning. Tsunami is a well-known IRC () bot used by miscreants for launching Distributed Denial of Service (DDoS) attacks whileis used for Telnet scanning.





KTN-RM, which researcher dubbed 'Remaiten,' features an improved spreading mechanism by carrying downloader executable binaries for embedded platforms and other connected devices.





How Does the Linux Malware Work?





The malware first performs Telnet scanning to look for routers and smart devices. Once the connection is made, the malware tries to guess the login credentials in an effort to take over weakly-secured devices.

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session



If it successfully logs in, the malware will issue a shell command to download bot executable files for multiple system architectures before running them on the compromised networking kit.

"This is a simple but noisy way of ensuring that the new victim gets infected because it is likely that one of the binaries is for the current platform," explained ESET Malware Researcher Michal Malík. "It targets mainly those with weak login credentials."

The malware, version 2.0, also has a welcome message for those who might try to neutralise its threat, containing a reference to the Malware Must Die blog.





Perhaps it is a way to take revenge, as Malware Must Die has published extensive details about Gafgyt, Tsunami and other members of this Malware family.



