InfectedSlurs Botnet Exploits Zero-Day RCE Vulnerabilities

Akamai has identified a recently discovered Mirai-based DDoS botnet called InfectedSlurs, actively taking advantage of two zero-day vulnerabilities to infect routers and video recorder (NVR) devices.

Although the researchers detected the botnet in October 2023, they suspect its activity dates back to at least 2022. Despite reporting the two vulnerabilities to the respective vendors, the fixes are scheduled for release in December 2023.

In October, Akamai's Security Intelligence Response Team (SIRT) observed unusual activity directed at the company's honeypots, specifically targeting an infrequently used TCP port.

The analysis published by Akamai reveals that in late October 2023, a slight increase in activity on their honeypots targeting a rarely utilized TCP port was spotted. Until November 9, 2023, the targeted devices were unidentified, and the probing involved low-frequency attempts. The method involved initiating authentication via a POST request, followed by command injection exploitation upon successful authentication.

Akamai refrained from disclosing the names of affected vendors. The researchers found that the bot also utilized default admin credentials to install Mirai variants. Further investigation into the campaign revealed that the bot targets wireless LAN routers designed for hotels and residential applications.

InfectedSlurs Based on JenX

InfectedSlurs is rooted in the JenX Mirai malware variant, which, in 2018, used the Grand Theft Auto videogame community to infiltrate devices. Akamai asserts that the InfectedSlurs code closely resembles that of the original Mirai botnet.

The experts noted that the variant employed in the October 2023 campaign shares the same functions and memory locations as a Mirai variant used in April 2023. Additionally, other botnets, including the hailBot Mirai variant, utilized the Command and Control (C2) infrastructure employed in this campaign. The researchers also identified references to some C2 infrastructure from a deleted Telegram user in the notorious DDoS marketplace channel DStatCC.

Akamai's SIRT is collaborating with CISA/US-CERT and JPCERT to notify vendors of the impacted devices. In an effort to allow vendors time to implement patches, detailed information is not being publicly disclosed. However, due to the active exploitation of these vulnerabilities, the report includes Snort and YARA rules to assist defenders in identifying exploit attempts and potential infections in their environments.