Mirai_Ptea Botnet Compromises DVR Devices
The creators of the Mirai Botnet may have no idea what they unleashed on the Internet once they decided to publish the source code of the project. This move enables any cybercriminal with some programming experience to craft their own variant of Mirai. This simple strategy has already given birth to dozens of botnet projects with varying success – the Simps Botnet is one of the recent examples. The new variant goes by the name Mirai_ptea Botnet, and it was first seen in March 2021.
The malware targets DVR devices manufactured by KGUARD and using outdated software. Thanks to vulnerabilities in old firmware, the criminals are able to plant the malicious file/script on the devices they compromise. The goal of the Mirai_ptea Botnet is to execute distributed-denial-of-service (DDoS) attacks, but it is not clear whether the criminals are renting out their project.
KGUARD DVRs are the Mirai_Ptea Botnet's Primary Target
The vulnerability, which the Mirai_ptea Botnet relies on enables its operators to execute remote commands on the vulnerable DVR devices. Typically, this would require an administrator account, but because of the vulnerability, the criminals can do so without any sort of authentication. The vulnerability affects a wide range of KGUARD DVR devices, so users of this hardware should make sure to apply the latest security patches.
The majority of Mirai_ptea Botnet's victims are situated in the United States, Korea, and Brazil. At the peak of the botnet's activity, it had over 10,000 bots active simultaneously – this allows for large-scale DDoS attacks. The somewhat good news is that the Mirai_ptea Botnet does not engage in other suspicious activity – just DDoS. It does not use compromised systems to try and scan the Web for more victims, nor does it engage in ad-fraud or cryptojacking campaigns.
The best way to mitigate such attacks is to ensure that all network-connected hardware receives regular software updates, as well as that you are using secure login credentials.
