By ; Nahla Muqalad
Researchers from Unit 42, the threat intelligence arm of Palo Alto Networks, have discovered a new variant of the Muhstik botnet that adds a scanner to attack Tomato routers for the first time by web authentication brute forcing.
Unit 42’s investigation showed there are more than 4,600 Tomato routers exposed on the internet that could potentially be vulnerable.
Tomato is an open source alternative firmware for routers. Thanks to its stable, Linux-based, non-proprietary firmware, with VPN-passthrough capability and advanced quality of service (QoS) control, Tomato firmware is commonly installed by multiple router vendors and also installed manually by end users. According to Unit 42’s investigation on Shodan, there are more than 4,600 Tomato routers exposed on the Internet.
The Muhstik botnet has been alive since March 2018, with a wormlike self-propagating capability to infect Linux servers and IoT devices. Muhstik uses multiple vulnerability exploits to infect Linux services, such as Weblogic, WordPress and Drupal. It also compromises IoT routers, such as the GPON home router and DD-WRT router. This new variant expands the botnet by infecting Tomato routers.
We have not found further malicious activities in Tomato routers after the Muhstik botnet harvests vulnerable routers, but from our understanding of the Muhstik botnet, Muhstik mainly launches cryptocurrency mining and DDoS attacks in IoT bots to earn profit. We will keep monitoring its Command and Control (C2) IRC channel.
The full report can be read here.
