Story image

Kaiten malware returns, more powerful says ESET

05 Apr 16

Researchers at ESET have discovered an improved version of Kaiten, an Internet Relay Chat (IRC)-controlled malware typically used to carry out distributed denial-of-service (DDoS) attacks. 

The digital security firm says the latest version targets embedded systems such as routers, gateways and wireless access points.

The remastered malware has been dubbed “KTN-Remastered” or “KTN-RM”, with three versions of Linux/Remaiten already identified by ESET researchers. Based on artifacts in the code, the main feature of the malware is an improved spreading mechanism.

Based primarily on Linux/Gafgyt’s telnet scanning, KTN-RM improves on that spreading mechanism by carrying downloader executable binaries for embedded platforms such as routers and other connected devices, ESET says, targeting mainly those with weak login credentials.

According to ESET, Linux/Remaiten improves upon this spreading mechanism by carrying downloader executables for CPU architectures that are commonly used in embedded Linux devices such as ARM and MIPS. 

After logging on via the telnet prompt of the victim‘s device, it tries to determine the new victim‘s device platform and transfer only the appropriate downloader. This downloader’s job is to request the architecture-appropriate Linux/Remaiten bot binary from the bot’s C&C server. This binary is then executed on the new victim‘s device, creating another bot for the malicious operators to use.

“The downloader‘s job is to request the Linux/Remaiten bot binary from the Command & Control server for its current architecture. When executed, it also creates another bot for the malicious operators to use. We have seen this technique used before by Linux/Moose to spread infections,“ explains Michal Malík, ESET malware researcher.

In a strange twist, this strain of malware also has a message for those who might try to neutralise its threat, Malík says. 

"Within the welcome message, version 2.0 seems to single out malwaremustdie.org which has published extensive details about Gafgyt, Tsunami and other members of this family of malware," he explains.

How to prevent and protect against this threat:

  • Change default passwords on network equipment even if it is not reachable from the Internet. Disable Telnet login and use SSH where possible
  • Run the latest firmware available from your embedded device vendor
  • Have an updated and appropriate anti-malware protection
  • Be aware of the malware threat and what it does to devices
  • If your computer is infected, it might be used to infect others
  • Always have a copy of your data. In case of infection, this will help you recover all of your information
  • If infected, the computer needs to be taken offline and cleaned as quickly as possible
  • If infected, reboot the affected device then change its password as soon as possible. However, the attackers may have had manual access so further infection may have happened. In that case, a factory reset, firmware update or reinstall and password change is probably best
Tensions on the rise after Huawei CFO arrest
“Recently our corporate CFO, Meng Wanzhou, was provisionally detained by the Canadian authorities on behalf of the United States of America."
Palo Alto Networks integrates RedLock and VM-Series with AWS Security Hub
AWS Security Hub is designed to provide users with a comprehensive view of their high-priority security alerts and compliance status.
Juniper simplifies data integration to improve threat detection
Updates to the Juniper Advanced Threat Prevention Appliances leverage third-party firewalls and security data sources.
Is mobile shopping compromising your enterprise security?
When employees do their holiday shopping on company resources, security teams have a challenge with the surge in browsing and online transactions.
Different approach to malware detection needed – VMware
Security needs to move away from the traditional approach of chasing after arbitrary forms of malware.
Modernising ERP systems can help organisations comply with GDPR
“Organisations need to look for modern ERP systems that are specifically designed with GDPR in mind."
APRA Prudential Standard CPS 234: How to communicate with the board
The Australian Prudential Regulation Authority’s standard, CPS 234, is aimed at minimising the threat of cyber attacks for APRA-regulated entities.
Cyber attacks develop complexity, target Windows sysad tools - report
The report explores changes in the threat landscape over the past year, uncovering trends and how they are expected to impact cybersecurity in 2019.