Patch Now: New Mirai, Gafgyt Variants Target 16 Flaws Via Multi-Exploits

[Read: The Equifax Breach: What to do now and what to watch out for]

One of the targets of the new Mirai variant is CVE-2017-5638, a known remote code execution (RCE) vulnerability in Apache Struts that attackers exploited with Object Graph Navigation Language (OGNL). The remaining 15 vulnerabilities include RCE flaws and an OS command injection security glitch in enterprise-used routers, NVRs, CCTVs and DVRs. The Gafgyt samples exploit CVE-2018-9866, a flaw found in unsupported versions caused by insufficient sanitization of the remote procedure call (XML-RPC).

 [Read: Critical Remote Code Execution vulnerability (CVE-2018-11776) found in Apache Struts]

Researchers uncovered that the Mirai samples were recently moved to a domain with an IP address also hosting the new variants of Gafgyt. The discovery is significant as these are the first recorded Mirai variants targeting Apache Struts. Additionally, these activities may serve as a warning that the incorporation of these multi-exploits for IoT and Linux botnets could indicate that the attackers are moving from consumer devices to enterprise targets with outdated versions, since organizations use the open source application framework to develop Java EE web applications. Left unchecked and unpatched, attackers could use these devices in distributed denial of service (DDoS) campaigns.

[Read: Open ADB ports being exploited to spread possible Satori variant in Android devices]

Patches released for earlier vulnerabilities should be updated as soon as possible. Additionally, make sure that your home network security is updated, as a compromised home device can also expose enterprise assets to risks. Here are some suggestions to improve your digital security hygiene:

• Update your software and firmware to prevent vulnerability exploits.
• Change your devices' default security credentials to prevent unauthorized access.
• Enable the routers’ built-in firewall.
• Download and use software and applications from legitimate app stores and vendors, especially if your IoT devices connect to mobile devices.