The researchers did not discover an exploit used for initial access, they speculate threat actor likely used weak credentials or exploited an exposed administrative interface.<\/p>\n\n\n\n

The first-stage payload is a bash script (“get_scrpc”) that fetches a second script called “get_strtriiush.” get_strtriiush retrieves and executes the primary bot payload, “Chalubo” (“mips.elf”). Chalubo runs in the memory of the targeted device and wipes all files from the disk. It also changes the process name after its execution to avoid detection. <\/p>\n\n\n\n

The researchers noticed that the newer version of the malware does not maintain persistence on the infected devices.<\/p>\n\n\n\n

Between September and November 2023, the research discovered that there were about 45 malware panels exposed on the internet. While 28 of the panels interacted with 10 or fewer bots, the top ten panels interacted with anywhere between ~13,500 to ~117,000 unique IP addresses over a 30-day timeframe. The analysis of the telemetry associated with those IP addresses revealed that over 650K unique IP addresses had contact with at least one controller over a 30-day period ending on November 3. <\/p>\n\n\n\n

95% of the bots communicated with only one control panel a circumstance that suggests the entity behind these operations had distinct silos of operations.<\/p>\n\n\n\n