Gafgyt Malware Infect Wireless Routers and Recruit into Botnets to Attack Gaming Servers

by chebbi abir

Researchers discovered a new malware variant dubbed Gafgyt infect IoT devices specifically routers used in a small office and home network. The malware variant targets commercial routers like Zyxel, Huawei, and Realtek.

It exploits remote execution code vulnerability in routers to gain access and recruit them to into botnets to attack gaming servers.

Vulnerability Exploited

According to Unit 42 researchers, there are more than 32,000 WiFi routers are vulnerable to the exploits. It abuses the following vulnerabilities to gain access to the routers.

  • CVE-2017-18368 – ZYXEL P660HN-T1A – New in this variant
  • CVE-2017-17215 – Huawei HG532 – Present in JenX as well.
  • CVE-2014-8361 – Realtek RTL81XX Chipset – Present in JenX as well.

The Gafgyt malware active since 2014, it is known for conducting large-scale DDoS attack, the malware includes three scanners that exploit the remote code execution vulnerabilities present on the routers.

Scanners used in Malware Pic: unit42

The exploits crafted as binary droppers, which downloads the binary from the malicious server based on the router type and try to infect them.

CVE-2017-18368 – ZYXEL P660HN-T1A

The first exploit is a command injection on Zyxel P660HN wireless routers, the command injection vulnerability resides in [ViewLog.asp] page and it can be exploited through the remote_host parameter.

CVE-2017-17215 – Huawei HG532

The second exploit abuses a remote code execution vulnerability found on HG532 routers. the vulnerability can be exploited by an attacker sending malicious packets to TCP port 37215 to launch attacks.

CVE-2014-8361 – Realtek RTL81XX Chipset

The flaw disclosed in 2014 with some Realtek routers which lead to remote code execution.”The miniigd SOAP service, implemented in Realtek SDK, allows remote attackers to execute arbitrary code via a crafted NewInternalClient request,” reads blog post.

The Gafgyt malware variant uses different attack types based on the commands received from the C2 server. Following are the commands

HTTP – HTTP flooding attack
HTTPHex – Aimed to exhaust server resources
HTTPCF – Attack against services secured by Cloudflare
KILLER & KILLATTK – Kills competing botnets
VSE – Payload to attack gaming servers


To read the original article:


Interdit de copier  ce contenu