Enemybot Botnet Goes After Routers and IoT Devices
The Mirai Botnet might just be one of the most impactful malware families to be released ever. The infamous threat was responsible for one of the largest botnets engaging in distributed-denial-of-service attacks, and its source code is still being used by cybercriminals to this very day. One of the latest major variants of Mirai is dubbed the Enemybot Botnet, and it appears to be the product of a cybercrime organization known as Keksec. They have been engaging in a wide range of cybercrime activities over the past few years, and the Enemybot Botnet appears to be one of their more successful ventures.
Just like other Mirai variants, this one also goes after internet-of-things (IoT) devices and routers using various architectures. The criminals are using a 'scanner' tool from the original Mirai project to discover vulnerable devices, and then "clear them out" of any competitors. This means that the Enemybot Botnet is able to identify other botnet variants, wipe them out, and take over the device completely. The criminals are going after D-Link, Zhone, and Netgear routers primarily. However, it is possible that other manufacturers might be among their targets as well.
It is improtant to add that the Enemybot Botnet appears to be under active development, and the Keksec hackers continue to expand its features. For now, they seem to be focused on enhancing the botnet's ability to stay undetected by working on a TOR-based command-and-control server that is changed regularly.
The best way to ensure that the Enemybot Botnet or a similar threat does not take over your Internet-connected devices is to use updated firmware, and secure login credentials.
