IoT Reaper 'will be worse than Mirai'

Researchers discover botnet that enslaves devices with unpatched flaws

A botnet that has the potential to be worse than Mirai is "actively expanding" across millions of vulnerable IoT devices, researchers have warned.

IoT Reaper has taken over tens of thousands of web-connected devices so far, and it has identified millions more to infect with a malicious code, researchers at 360 Netlab revealed on Friday.

While Reaper shares some of its code with Mirai, the botnet that last year cut access to some of the world's biggest sites, like Twitter, before being open sourced, the researchers who discovered it believe it is far more dangerous than its relative.

Mirai hijacked devices by cracking those using default or weak passwords, but Reaper targets devices with unpatched vulnerabilities.

Netlab's team spotted nine existing IoT flaws integrated into Reaper's malware, affecting manufacturers like Linksys, AVTech, and Netgear.

"Note just in the last 10 days, the attacker has continuously added more new exploits into samples, one of which is [sic] adopted only 2 days after the disclosure of the vulnerability was made," the team wrote in a blog post.

One Reaper command and control server has managed to control 20,000 devices in the week before Netlab revealed the botnet, and another controlled 10,000 in a single day. More than two million are queued up for infection by another command and control server.

Netlab's researchers said: "We have not seen actual DDoS attack so far. The only instructions we saw are to download samples. This means the attacker is still focusing on spreading the botnets."

"To stop the propagation of this botnet, all companies and consumers should ensure all their devices are running the latest firmware versions, which will have security patches included," said Tristan Liverpool, direcor of systems engineering at F5 Networks.

"However, as the Reaper botnet already has many devices under its control ... everyone needs to prepare for the worst, as it is still unknown whether the motive of the perpetrators is chaos, financial gain or to target specific states or brands."

Picture: Bigstock

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

The smart buyer’s guide to flash

Find out whether flash storage is right for your business

Download now

How MSPs build outperforming sales teams

The definitive guide to sales

Download now

The business guide to ransomware

Everything you need to know to keep your company afloat

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
2021 state of email security report: Ransomware on the rise
Whitepaper

2021 state of email security report: Ransomware on the rise

10 May 2021
Hackers used SonicWall zero-day flaw to plant ransomware
ransomware

Hackers used SonicWall zero-day flaw to plant ransomware

30 Apr 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021