Old D-Link Vulnerabilities Fuel Global Attacks by FICORA and Kaiten Botnets

Dec 27, 2024
Botnet / DDoS Attack

Cybersecurity experts are alerting to a rise in malicious activity that leverages outdated D-Link routers, involving two distinct botnets: a Mirai variant known as FICORA and a Kaiten variant referred to as CAPSAICIN. “These botnets are often propagated through well-documented vulnerabilities in D-Link devices, enabling remote attackers to execute harmful commands via GetDeviceSettings on the HNAP (Home Network Administration Protocol) interface,” noted Vincent Li, a researcher at Fortinet FortiGuard Labs, in a Thursday analysis. “This HNAP flaw was first revealed nearly ten years ago, affecting multiple devices across various CVE identifiers, including CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.” According to telemetry data from the cybersecurity firm, attacks linked to FICORA have been globally dispersed, while those involving CAPSAICIN have predominantly targeted East Asian countries like Japan and Taiwan.

FICORA and Kaiten Botnets Target D-Link Vulnerabilities for Global Cyber Assaults

On December 27, 2024, cybersecurity experts issued a cautionary update regarding a surge in cybercriminal activities leveraging outdated vulnerabilities in D-Link routers. These exploits have led to the formation of two distinct botnets: the Mirai variant identified as FICORA and a Kaiten variant referred to as CAPSAICIN. Research conducted by Vincent Li at Fortinet’s FortiGuard Labs indicates these attacks capitalize on known D-Link weaknesses, allowing adversaries to execute harmful commands through a GetDeviceSettings action utilizing the Home Network Administration Protocol (HNAP) interface.

The vulnerabilities in question have been identified over the past decade, affecting numerous devices and designated under several CVE identifiers, including CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112. This prolonged exposure to security flaws raises significant concerns about the integrity of devices still operational in the field.

Attack patterns suggest that while FICORA has been disseminating across various international targets, CAPSAICIN, on the other hand, has been particularly focused on East Asian nations, especially Japan and Taiwan. This geographic targeting underscores the need for region-specific security strategies and heightened awareness of potential threats in those locales.

According to telemetry data from Fortinet, organizations leveraging these vulnerable D-Link routers may find themselves inadvertently enlisted in larger, orchestrated DDoS attacks. Such involuntary participation can significantly impact network performance and security posture, ultimately jeopardizing operational continuity for businesses.

From an analytical standpoint, understanding the MITRE ATT&CK framework offers insights into the tactics and techniques likely employed by these adversaries. Initial access methods probably included exploiting known vulnerabilities, thus enabling persistence within compromised networks. Following this, attackers could escalate privileges to gain further control over devices, transforming innocent IoT routers into instruments for larger-scale cyber offensives.

The ramifications of this ongoing trend are troubling, particularly for business owners who must remain vigilant against evolving threats. Firewalls, intrusion detection systems, and regular updates are essential measures to help mitigate the risks associated with such botnet activities. Ultimately, the combination of outdated devices and known vulnerabilities presents a compelling case for immediate action to protect organizational assets from potential exploitation.

As the threat landscape continues to evolve, it is imperative for businesses to stay informed and proactive in their cybersecurity strategies. Recognizing the potential for exploitation from systemic vulnerabilities, like those found in D-Link routers, should drive an urgent reassessment of current security protocols. In this atmosphere of escalating cyber threats, only sustained vigilance can safeguard against the impacts of such malicious activities.

Source link

Related Posts

Researchers Reveal Four-Month Cyberattack on U.S. Firm Tied to Chinese Hackers

Dec 05, 2024
Threat Intelligence / Cyber Espionage

A suspected Chinese threat actor infiltrated a prominent U.S. organization earlier this year in a four-month-long cyber assault. According to Broadcom-owned Symantec, the first signs of the breach were detected on April 11, 2024, and continued until August, with the possibility of earlier activity not being ruled out.

“The attackers moved laterally within the organization’s network, compromising multiple computers,” reported the Symantec Threat Hunter Team in a release to The Hacker News. “Some targeted machines were Exchange Servers, indicating that the attackers were likely gathering intelligence through email harvesting. Additionally, exfiltration tools were deployed, implying that sensitive data was extracted from the organization.”

The identity of the affected organization remains undisclosed, though it is significant in size and presence in China. The implications of these links to Chinese actors …

🔒 Weekly Cybersecurity Recap: Key Threats, Tools, and Strategies (Dec 2 – 8)

Dec 09, 2024

Cyber Threats / Weekly Overview

This week’s cybersecurity landscape reads like a thrilling spy film. Hackers are infiltrating rival operations, stealthy malware lurks in widely-used software, and AI-driven scams are outsmarting even the brightest minds. Meanwhile, defenders are dismantling illicit online markets and shutting down dubious chat rooms, while major corporations scramble to patch vulnerabilities before attackers can exploit them. Curious about who’s targeting whom, the tactics they’re using, and the countermeasures in play? Keep reading—this recap has all the details.

⚡ Threat of the Week: Turla Hackers Compromise Pakistani Hacker Network

Picture this: one hacking group infiltrates another’s covert operations to launch their own attacks. That’s the scenario unfolding as the Russia-linked Turla group has been leveraging the infrastructure of a Pakistani hacking team, Storm-0156, since December 2022. By breaching their servers, Turla is now spying on governmental and military entities in Afghanistan and India.