Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall By Ruchna Nigam Published: 2018-09-10 · Archived: 2026-04-05 21:26:53 UTC Executive Summary: Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in November 2016 and since. These variants are notable for two reasons: The new Mirai version targets the same Apache Struts vulnerability associated with the Equifax data breach in 2017. The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS). These developments suggest these IOT botnets are increasingly targeting enterprise devices with outdated versions. All organizations should ensure they keep not only their systems up-to-date and patched, but also their IoT devices. For Palo Alto Networks customers, WidlFire detects all related samples with malicious verdicts. Additional protections are noted in the conclusion below. Research: On September 7, 2018, Unit 42 found samples of a Mirai variant that incorporates exploits targeting 16 separate vulnerabilities. While the use of multiple exploits within a single sample of Mirai has been observed in the past, this is the first known instance of Mirai targeting a vulnerability in Apache Struts. In addition, Unit 42 found the domain that is currently hosting these Mirai samples previously resolved to a different IP address during the month of August. During that time this IP was intermittently hosting samples of Gafgyt that incorporated an exploit against CVE-2018-9866 a SonicWall vulnerability affecting older versions of SonicWall Global Management System (GMS). SonciWall has been notified of this development. The incorporation of exploits targeting Apache Struts and SonicWall by these IoT/Linux botnets could indicate a larger movement from consumer device targets to enterprise targets. Apache Struts exploit in multi-exploit Mirai variant The exploit targeting Apache Struts in the new variant we found targets CVE-2017-5638, an arbitrary command execution vulnerability via crafted Content-Type, Content-Disposition, or Content-Length HTTP headers. Its format can be seen in Figure 1, with the payload highlighted. Figure 1 CVE-2017-5638 exploit format The other 15 exploits incorporated in this Mirai variant are detailed in Table 2 in the Appendix below. While these samples are variants of Mirai, they don’t include the bruteforce functionality generally used by Mirai. They use l[.]ocalhost[.]host:47883 as C2, and the same encryption scheme as Mirai with the key 0xdeadf00d. SonicWall GMS exploit in Gafgyt variant The domain l[.]ocalhost[.]host used for C2 and to serve payloads in the Mirai variant discussed above, has also been found associated with other Mirai activity in the past as far back as November 2016. For part of the month of August 2018, that same domain resolved to a different IP address 185[.]10[.]68[.]127. At that time we found that IP hosting samples of Gafgyt containing an exploit for a recently disclosed SonicWall vulnerability (CVE-https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/ Page 1 of 7 2018-9866) affecting older, unsupported versions of SonicWall Global Management System (GMS) (8.1 and older) that is not present in currently supported versions. The vulnerability CVE-2018-9866 targeted by the exploit stems from the lack of sanitization of XML-RPC requests to the set_time_config method. Figure 2 shows the exploit used in the sample, with the payload highlighted. Figure 2 SonicWall set_time_config RCE format These samples first surfaced on August 5, less than a week after the publication of a Metasploit module for this vulnerability. The SonicWall public advisory on the issue published on July 17, 2018, can be found here. The samples we found are built using the Gafgyt codebase rather than Mirai. Some of the commands supported are described in the table below. Command Description !* SCANNER Based on arguments provided, the bot starts sending the associated exploit to devices. ·      HUAWEI: Send CVE-2017-17215 (See previous campaigns) ·      GPON: Same as above ·      DLINK: Send D-Link DSL 2750B OS Command Injection (see Table 2) ·      SONICWALL: Send exploit in Figure 2. ·      OFF: kills the running process associated with the bot !* BIN_UPDATE Fetches an update from , saves it to , installs update !* BN