Researchers have spotted a recent surge in activity involving a Mirai distributed denial-of-service botnet variant called CatDDoS. The attacks have targeted organizations across multiple sectors and include cloud vendors, communication providers, construction companies, scientific and research entities, and educational institutions in the US, France, Germany, Brazil, and China.
Multiple Variants The malware first surfaced last August and was a relatively prolific threat in September 2023.
CatDDoS dropped largely out of sight in December, prompting researchers tracking the threat at China's QiAnXin XLab to assume the operators of the malware may have pulled its plug.
In a report issued this week, QiAnXin said its researchers have observed multiple gangs using CatDDoS variants during the past three months.
The operators of the variants, which are being tracked under various names, including RebirthLTD, Komaru, and Cecilio Network, have so far exploited at least 80 different vulnerabilities in their new campaign, QiAnXin said.
The vulnerabilities being exploited under the CatDDoS umbrella affect dozens of products and technologies, including Apache ActiveMQ Servers, Apache Log4j, Cisco Linksys, Jenkins servers, and NetGear routers.
Many of the vulnerabilities are recent, meaning they were disclosed over the past year.
There are numerous others that CatDDoS threat actors are leveraging that are relatively old.
Among them is CVE-2010-2506, a nearly 14-year-old vulnerability in Linksys firmware; CVE-2013-1599, a more than decade-old flaw in D-Link IP cameras; and CVE-2011-5010, a remote code execution vulnerability in Ctek SkySouters from 2011.
CatDDoS actors have been compromising upward of 300 targets per day in the latest wave of attacks.
The CatDDoS variants that the security vendor has observed all appear to be based on source code that the authors of the original malware publicly released in December after a futile bid to get someone to buy it off them.
A Potent Threat, as Always DDoS malware and botnets remain a potent threat for organizations worldwide.
Though many organizations have built substantial redundancies into their network infrastructure to accommodate sudden DDoS-related traffic spikes, threat actors have upped their game as well.
A recent report from Nexusguard showed threat actors have shifted their attack focus to individual computers and servers.
These systems were the primary target in 92% of the DDoS attack attempts that Nexusguard spotted last year - up sharply from just 68% a year ago.
The company attributed the shift in focus to new vulnerabilities in Windows systems and the availability of malware that made it easier for attacks to compromise these systems,.
Significantly, though DDoS attack volumes dropped 55% in 2023, the size of individual attacks grew 233%. In many of these attacks, threat actors continued to rely on NTP amplification - a technique that massively boosts attack traffic.
Nexusguard said, they also relied on other techniques such as DNS amplification and HTTPS flooding methods to boost attack traffic volumes.
This Cyber News was published on www.darkreading.com. Publication date: Tue, 28 May 2024 21:25:25 +0000