A new self-propagating DDoS botnet written in Go is actively targeting IoT devices, leveraging a mix of known exploits and weak credentials to build a swarm capable of multi-vector attacks. Akamai’s SIRT has been tracking this variant, which shows a clear evolution in payload delivery and C2 resilience compared to older Mirai-based strains.
Technical Breakdown – Initial Access: Scans for exposed Telnet (23) and SSH (22) services, then brute-forces using a hardcoded dictionary of ~30 common IoT credentials (e.g., root/root, admin/1234). – Exploitation: Uses a bundled set of known CVEs for propagation, including remote code execution flaws in specific router and camera firmware. The Go binary is architecture-aware, dropping the correct ELF for ARM, MIPS, or x86 targets. – Persistence & C2: Establishes a TLS-encrypted channel to a rotating set of C2 domains. The bot uses a custom XOR-based obfuscation for its configuration strings to evade static signature detection. – Attack Capabilities: Supports multiple DDoS vectors: HTTP/HTTPS flood, DNS amplification, and TCP SYN flood. The bot can receive real-time attack parameter updates from the C2. – IOCs: Akamai has published specific C2 domains and sample SHA256 hashes of the Go binaries in their full report. (Note: IOCs are time-sensitive; pull the latest from the source link.)
Defense Block outbound traffic from IoT segments to unknown external hosts on non-standard ports. Enforce credential rotation on all embedded devices and disable Telnet where possible. Network-level detection should focus on anomalous TLS handshakes from device subnets to known-bad ASNs.
Source: r/SecOpsDaily · by /u/falconupkid