IoT Reaper 'will be worse than Mirai'

Researchers discover botnet that enslaves devices with unpatched flaws

A botnet that has the potential to be worse than Mirai is "actively expanding" across millions of vulnerable IoT devices, researchers have warned.

IoT Reaper has taken over tens of thousands of web-connected devices so far, and it has identified millions more to infect with a malicious code, researchers at 360 Netlab revealed on Friday.

While Reaper shares some of its code with Mirai, the botnet that last year cut access to some of the world's biggest sites, like Twitter, before being open sourced, the researchers who discovered it believe it is far more dangerous than its relative.

Mirai hijacked devices by cracking those using default or weak passwords, but Reaper targets devices with unpatched vulnerabilities.

Advertisement - Article continues below
Advertisement - Article continues below

Netlab's team spotted nine existing IoT flaws integrated into Reaper's malware, affecting manufacturers like Linksys, AVTech, and Netgear.

"Note just in the last 10 days, the attacker has continuously added more new exploits into samples, one of which is [sic] adopted only 2 days after the disclosure of the vulnerability was made," the team wrote in a blog post.

One Reaper command and control server has managed to control 20,000 devices in the week before Netlab revealed the botnet, and another controlled 10,000 in a single day. More than two million are queued up for infection by another command and control server.

Netlab's researchers said: "We have not seen actual DDoS attack so far. The only instructions we saw are to download samples. This means the attacker is still focusing on spreading the botnets."

"To stop the propagation of this botnet, all companies and consumers should ensure all their devices are running the latest firmware versions, which will have security patches included," said Tristan Liverpool, direcor of systems engineering at F5 Networks.

"However, as the Reaper botnet already has many devices under its control ... everyone needs to prepare for the worst, as it is still unknown whether the motive of the perpetrators is chaos, financial gain or to target specific states or brands."

Advertisement - Article continues below

Picture: Bigstock

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now



Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019

Best free malware removal tools 2019

23 Dec 2019

Best antivirus for Windows 10

3 Sep 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020

Windows 10 and the tools for agile working

20 Jan 2020
public sector

UK gov launches £300,000 SEN EdTech initiative

22 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020