ShadowV2 poses new threat to vulnerable IoT devices

"The Mirai ecosystem has a new variant that, according to researchers at Fortinet, may have been used as a test for future large-scale attacks. The malware, known as ShadowV2, exploited a series of vulnerabilities in IoT devices from D-Link, TP-Link, DigiEver, TBK, DD-WRT, and others in late October. The activity coincided exactly with the global AWS outage and also stopped as soon as the outage was resolved."

"ShadowV2 targeted routers, NAS systems, and DVRs known for their long lifespans and limited update policies. Many affected models no longer receive firmware updates, leaving them vulnerable to known exploits. The malware spread via multiple exploits and used a downloader script that was activated as soon as a vulnerable device was found. The payload was then retrieved from a server previously associated with Mirai variants."

"Once active, ShadowV2 identifies itself as ShadowV2 Build v1.0.0 IoT version, leading Fortinet to suspect that this is the first full iteration of this specific botnet variant. Limited scale infections The attacks were detected in North and South America, Europe, Africa, Asia, and Australia. Although the scale of the infection remained limited, according to Fortinet, the spread shows that IoT-targeting botnets can still easily gain a foothold worldwide as soon as sufficient vulnerable equipment is available."

ShadowV2 is a Mirai-related IoT botnet variant that exploited multiple known vulnerabilities in routers, NAS devices, and DVRs from vendors including D-Link, TP-Link, DigiEver, TBK, and DD-WRT in late October. The campaign coincided with a global AWS outage and ceased when the outage resolved, suggesting a trial run to validate methods and infrastructure. Infections were detected across all inhabited continents but remained limited in scale. The malware spread via multiple exploits, used a downloader to fetch a payload from a server linked to Mirai variants, identifies as Build v1.0.0, and supports UDP, TCP, and HTTP DDoS methods.

Read at Techzine Global