THE RESURGENCE OF IOT MALWARE: INSIDE THE MIRAI-BASED BOTNET CAMPAIGN

Summary from the TLDR InfoSec newsletter

The Gayfemboy botnet exploits vulnerabilities in DrayTek, TP-Link, Raisecom, and Cisco devices to deploy a Mirai-variant that uses modified UPX packing, custom architecture naming schemes, and hardcoded process termination lists to eliminate competing malware infections. The malware implements sophisticated evasion techniques, including 50-nanosecond sandbox delays, utilizes public DNS servers (1.1.1.1, 8.8.8.8) to bypass local filtering, and scans 15 predefined ports for C2 communication with domains such as cross-compiling[.]org and i-kiss-boys[.]com. Organizations should implement network monitoring for unusual DNS queries to public resolvers, deploy IPS signatures for the listed CVEs, and monitor for processes attempting to bind to UDP port 47272 or exhibiting the malware's distinctive process termination behavior.