IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

IoT Reaper 'will be worse than Mirai'

Researchers discover botnet that enslaves devices with unpatched flaws

A botnet that has the potential to be worse than Mirai is "actively expanding" across millions of vulnerable IoT devices, researchers have warned.

IoT Reaper has taken over tens of thousands of web-connected devices so far, and it has identified millions more to infect with a malicious code, researchers at 360 Netlab revealed on Friday.

While Reaper shares some of its code with Mirai, the botnet that last year cut access to some of the world's biggest sites, like Twitter, before being open sourced, the researchers who discovered it believe it is far more dangerous than its relative.

Mirai hijacked devices by cracking those using default or weak passwords, but Reaper targets devices with unpatched vulnerabilities.

Netlab's team spotted nine existing IoT flaws integrated into Reaper's malware, affecting manufacturers like Linksys, AVTech, and Netgear.

"Note just in the last 10 days, the attacker has continuously added more new exploits into samples, one of which is [sic] adopted only 2 days after the disclosure of the vulnerability was made," the team wrote in a blog post.

One Reaper command and control server has managed to control 20,000 devices in the week before Netlab revealed the botnet, and another controlled 10,000 in a single day. More than two million are queued up for infection by another command and control server.

Netlab's researchers said: "We have not seen actual DDoS attack so far. The only instructions we saw are to download samples. This means the attacker is still focusing on spreading the botnets."

"To stop the propagation of this botnet, all companies and consumers should ensure all their devices are running the latest firmware versions, which will have security patches included," said Tristan Liverpool, direcor of systems engineering at F5 Networks.

"However, as the Reaper botnet already has many devices under its control ... everyone needs to prepare for the worst, as it is still unknown whether the motive of the perpetrators is chaos, financial gain or to target specific states or brands."

Picture: Bigstock

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022