New Zerobot Variant Exploits Additional Vulnerabilities for Propagation

Description

FortiGuard Labs is aware of a report that a new Zerobot variant is capable of propagating to other devices by exploiting known vulnerabilities. Zerobot was first reported in a blog released by Fortinet on December 06, 2022. Devices infected with Zerobot connect to Command-and-Control C2) server and can take part in DDoS attacks.

Why is this Significant?

This is significant because a new Zerobot variant was updated to exploit additional vulnerabilities for propagation. Since previous variants of Zerobot were recently found, Zerobot developer is currently putting constant effort to improve malware. Because of this - patches should be applied to vulnerable devices as soon as possible.

What is Zerobot?

Zerobot is a Go-based malware recently discovered by Fortinet that runs on Linux and Windows platforms. Zerobot contains several modules, including self-replication, attacks for different protocols, and self-propagation. It also communicates with its command-and-control server using the WebSocket protocol.

While Zerobot can spread to other devices by exploiting vulnerabilities and performing brute-force attacks, the malware is reportedly unable to propagate to Windows machines.

For more information on Zerobot, see the Appendix for a link to "Zerobot - New Go-Based Botnet Campaign Targets Multiple Vulnerabilities".

Appendix

Microsoft research uncovers new Zerobot capabilities (Microsoft)

Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities (Forinet)

Outbreak Alert: Zerobot Attack (Fortinet)