Summary: [/subscribe_to_unlock_form]
Summary: [emaillocker id="1283"]
A new Go-based, DDoS-targeted botnet named “HinataBot” has been found by researchers. The authors and operators of HinataBot were observed distributing it throughout the first three months of 2023, and it is now being updated. The sample was found to utilize outdated vulnerabilities and weak credentials in HTTP and SSH honeypots. Exploiting the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and vulnerable Hadoop YARN servers (CVE N/A) are just a few of the infection attempts that have been spotted.
HinataBot, which is followed by botnets like GoBruteForcer and kmsdbot. Attackers have taken advantage of Go-language to take advantage of its high performance, ease of multi-threading, support for multiple architectures, and cross-compilation across operating systems, but it's also probably because it adds complexity during compilation, making it harder to reverse engineer the resulting binaries. Several infector script iterations that were modified over time were employed by the attackers. The two most important of these scripts were given the names "wget.sh" and "tftp.sh," respectively, to reflect the different protocols required to obtain the necessary payload.
The attackers used brute-force methods to try common username and password combinations on the SSH honeypots. The attackers opened a shell and carried out the actions after successfully logging in. HinataBot has been observed with distributed denial-of-service (DDoS) flooding attacks that use protocols like HTTP, UDP, TCP, and ICMP to transmit traffic. It uses a variety of communication techniques, including both dialing out and listening for incoming connections. Nevertheless, HinataBot's most recent iteration has limited its attack options to just HTTP and UDP attacks.
HinataBot is the latest example of the evolving threat landscape, particularly in relation to botnets. Malware authors are continuing to innovate their use of implementation methods, languages, and distribution methods. By leaning on older, proven techniques, such as those used within Mirai, attackers can focus more on curating pieces that evade detection, continuously evolve, and add new functionality.
Threat Profile:
| Tactic | Technique Id | Technique |
| Resource Development | T1584 | Compromise Infrastructure |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation |
| Defense Evasion | T1070 | Indicator Removal |
| Credential Access | T1110 | Brute Force |
| Impact | T1498 | Network Denial of Service |
| T1499 | Endpoint Denial of Service |
References:
The following reports contain further technical details:
https://thehackernews.com/2023/03/new-golang-based-hinatabot-exploiting.html
[/emaillocker]