As of December 2022, Unit 42 researchers had observed 134 million exploit attempts leveraging a Realtek Jungle SDK vulnerability, with 97 of them occurring at the beginning of August 2022. Cybercriminals increased their efforts to exploit the remote code execution vulnerability, which affects almost 190 models of devices from 66 different manufacturers. This bug can create supply-chain issues, making it difficult for users to identify the products that attackers are exploiting. It is an arbitrary command injection and buffer overflow bug that could be leveraged to execute arbitrary code and gain the highest level of privileges, eventually hijacking the infected device appliance. Most of the attacks observed were attempts to deliver malware and compromise vulnerable IoT devices, indicating that threat actors aim to launch large-scale attacks against internet-connected devices worldwide. Around 50% of the attacks were launched from the USA, followed by Vietnam and Russia. Unit 42 identified three kinds of payloads that were distributed through in-the-wild exploitation of this bug. Attackers can exploit this bug to deliver known botnets such as Mozi, Mirai, Gafgyt, and the new Golang-based DDoS botnet called RedGoBot. Vulnerable IoT devices include IP cameras, routers, residential gateways, and Wi-Fi repeaters from at least 66 vendors, including Belkin, D-Link, ASUS, Huawei, LG, ZTE, Logitech, Zyxel, and NETGEAR. Additionally, millions of IoT devices are open to video snooping and ransomware installation due to ThroughTek Flaw and Access:7 Supply Chain Flaws.
This Cyber News was published on www.hackread.com. Publication date: Mon, 30 Jan 2023 22:54:03 +0000