Comment
Author: Admin | 2025-04-28
Have seen evidence to link the botnet to the P2PInfect worm, which was discovered by Unit 42 in July 2023.The malware obfuscation and custom code show a high level of operation security, which usually indicates mature threat actors, but the naming of the malware’s binaries and some its included strings are quite childish. This complicates attribution.We saw more than 800 different attacking IPs in 2023, spread evenly across the world.We have published indicators of compromise (IOCs), queries, signatures, and scripts that can be used to test for infection.Introduction\r\nNoaBot is yet another Mirai-based botnet. The Mirai botnet is a wormable botnet that targets Linux-based Internet of Things (IoT) devices. It is used for distributed denial-of-service (DDoS) attacks. The original Mirai botnet was identified in 2016, but its source code has been made public, and many variants can be seen nowadays.\r\nWe first detected the NoaBot campaign at the beginning of 2023. Since then, we’ve seen two evolutions of the malware, which consist of additional obfuscations or a change of command and control (C2) and mining pool domains (Figure 1). We’ve also seen several incidents that drop samples of the P2PInfect worm, which hints that the two campaigns are related.\r\n"}}"> IntroductionNoaBot is yet another Mirai-based botnet. The Mirai botnet is a wormable botnet that targets Linux-based Internet of Things (IoT) devices. It is used for distributed denial-of-service (DDoS) attacks. The original Mirai botnet was identified in 2016, but its source code has been made public, and many variants can be seen nowadays.We first detected the NoaBot campaign at the beginning of 2023. Since then, we’ve seen two evolutions of the malware, which consist of additional obfuscations or a change of command and control (C2) and mining pool domains (Figure 1). We’ve also seen several incidents that drop samples of the P2PInfect worm, which hints that the two campaigns are related. Fig. 1: Noabot malware activity over time The botnet\r\nThe NoaBot botnet has most of the capabilities of the original Mirai botnet (such as a scanner module and an attacker module, hiding its process name, etc.), but we can also see many differences from
Add Comment