In the rapidly evolving world of technology, the confrontation with cyber threats has become a daily occurrence with new, more sophisticated attacks emerging regularly. One of the notable recent developments in the cybersecurity realm is the emergence of a new Mirai botnet variant called Aquabot, which is prompting significant concerns about the security of Internet of Things (IoT) devices. This attack targets Mitel phones by exploiting a medium-severity security flaw, specifically a command injection flaw during the boot process.
The Nature of the New Threat: Aquabot DDoS Attacks
Mitel Phones’ Vulnerability
The vulnerability, labeled CVE-2024-41710, affects several series of Mitel phones, including the 6800, 6900, 6900w Series SIP phones, and the 6970 Conference Unit. This flaw allows the execution of arbitrary commands on affected phones, effectively enabling attackers to commandeer these devices for their malicious purposes. Mitel addressed this issue in July 2024, releasing a patch to correct the flaw. Despite this, the ease of exploiting this security hole was underscored by the rapid public availability of a proof-of-concept exploit by August.
The Aquabot botnet leverages Mirai’s established framework, its primary objective being to facilitate distributed denial-of-service (DDoS) attacks. By January 2025, researchers from Akamai, including Kyle Lefton and Larry Cashdollar, observed that Aquabot was actively trying to exploit CVE-2024-41710, using a payload nearly identical to the proof-of-concept exploit. This process involves a shell script that utilizes the “wget” command to retrieve Aquabot for multiple CPU architectures. This tactic ensures the malware can target a wide range of devices, amplifying the potential impact of the botnet.
Enhanced Features of Aquabot
One of the novel features incorporated into this latest version of the Mirai variant is the “report_kill” function. This function notifies a command-and-control (C2) server when a kill signal is detected on infected devices. Interestingly, the communication between infected devices and the C2 server does not seem to provoke any direct response from the server. This could imply that the update serves mainly for monitoring purposes, likely intended to track which devices remain part of the botnet.
Aquabot’s ability to disguise itself as “httpd.x86” to evade detection is another noteworthy feature, reflecting the increasingly sophisticated measures cybercriminals employ to prolong the lifecycle of their malware. Additionally, it is programmed to terminate specific processes, including local shells, likely to remove traces of its presence or to combat other malicious entities. The intent appears to be making its operations more covert and evading security protocols that might otherwise neutralize its activities.
Impacts on IoT Security and Countermeasures
Marketing and Misuse of Aquabot
Evidence has revealed that the Aquabot network is being marketed under various names such as Cursinq Firewall, The Eye Services, and The Eye Botnet on platforms like Telegram. While sellers often claim these services are meant for DDoS mitigation testing or educational use, closer scrutiny suggests their real intention is to offer DDoS-for-hire services. These botnets are advertised openly, frequently accompanied by boasts about their capabilities, which raises significant concern regarding the ease of access to such potent cyber weaponry.
This development underscores the persisting threat posed by Mirai-derived botnets to a range of internet-connected devices, particularly those with insufficient security measures, outdated software, or default settings. Such devices remain prime targets for exploitation, providing cybercriminals with an abundant supply of vulnerable systems to recruit into their botnets. The broader implication is the ever-present danger of large-scale DDoS attacks, which can disrupt services, cause substantial financial loss, and compromise sensitive data.
As IoT devices become more common in various sectors, the importance of addressing these security flaws cannot be overstated. Ensuring robust cybersecurity measures and regular updates are essential to protect against these evolving threats and safeguard both personal and organizational assets from potential harm.