IoT Reaper 'will be worse than Mirai'

Researchers discover botnet that enslaves devices with unpatched flaws

A botnet that has the potential to be worse than Mirai is "actively expanding" across millions of vulnerable IoT devices, researchers have warned.

IoT Reaper has taken over tens of thousands of web-connected devices so far, and it has identified millions more to infect with a malicious code, researchers at 360 Netlab revealed on Friday.

While Reaper shares some of its code with Mirai, the botnet that last year cut access to some of the world's biggest sites, like Twitter, before being open sourced, the researchers who discovered it believe it is far more dangerous than its relative.

Mirai hijacked devices by cracking those using default or weak passwords, but Reaper targets devices with unpatched vulnerabilities.

Netlab's team spotted nine existing IoT flaws integrated into Reaper's malware, affecting manufacturers like Linksys, AVTech, and Netgear.

"Note just in the last 10 days, the attacker has continuously added more new exploits into samples, one of which is [sic] adopted only 2 days after the disclosure of the vulnerability was made," the team wrote in a blog post.

One Reaper command and control server has managed to control 20,000 devices in the week before Netlab revealed the botnet, and another controlled 10,000 in a single day. More than two million are queued up for infection by another command and control server.

Netlab's researchers said: "We have not seen actual DDoS attack so far. The only instructions we saw are to download samples. This means the attacker is still focusing on spreading the botnets."

"To stop the propagation of this botnet, all companies and consumers should ensure all their devices are running the latest firmware versions, which will have security patches included," said Tristan Liverpool, direcor of systems engineering at F5 Networks.

"However, as the Reaper botnet already has many devices under its control ... everyone needs to prepare for the worst, as it is still unknown whether the motive of the perpetrators is chaos, financial gain or to target specific states or brands."

Picture: Bigstock

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021
What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021