New Gafgyt Botnet TOR Variant Targets D-Link and IoT Devices

The Gafgyt IoT botnet has been around for 7 years already, boasting many different variants over time. Also known as BASHLITE, this botnet has become notorious for launching DDoS attacks, making it almost as well-known as famous botnets such as Mirai in recent years. In 2018, two Gafgyt variants were detected, targeting Apache Struts and SonicWall vulnerabilities. Over the next year, Gafgyt started targeting vulnerable internet of things devices, wreaking havoc on gaming servers all over the world.

Recently, a new variant dubbed Gafgyt_tor by researchers was discovered. Although its main purpose is still DDoS, this new version has upped its evasion tactics, and is the first variant to use the Tor network to conceal its malicious activity. Weak Telnet passwords allow the cyber attackers behind the botnet to deploy their infections. This type of password exploitation is a widely known issue on IoT devices. In addition, the hackers exploit three vulnerabilities to deploy their attacks:

1. A remote code execution vulnerability in D-Link devices - CVE-2019-16920
2. A Lifespray enterprise portal software remote code execution vulnerability (no CVE available)
3. A vulnerability in Citrix Application Delivery Controller - CVE-2019-19781

The new variant’s main function, establishing a Tor connection, has replated the original initConnection() function which was used to establish communication with the botnet’s C2 servers. This way, Gafgyt_tor can hide its activity when it calls home. The new botnet variants is suspected to be built by the same threat actor that has been distributing previous variants, dubbed Freak threat actor or keksec group.

ThreatSTOP customers are automatically protected from threats like Gafgyt botnet through blocking the IP addresses for the C2 servers, and/or blocking the domains being used, which may be newly registered or observed. If you are not yet a ThreatSTOP user, we recommend blocking the IOCs below.