Infamous IoT Botnet Mozi Taken Down, Says ESET

Infamous IoT Botnet Mozi Taken Down, Says ESET

ESET Research recently observed the sudden demise of one of the most prolific Internet of Things (IoT) botnets, named Mozi, infamous for exploiting vulnerabilities in hundreds of thousands of IoT devices each year. User Datagram Protocol (UDP) observed an unanticipated drop in activity that began in India and was also observed in China a week later. The change was caused by an update to Mozi bots that stripped them of their functionality. A few weeks following these events, ESET researchers were able to identify and analyze the kill switch that caused Mozi’s demise.

“The demise of one of the most prolific IoT botnets is a fascinating case of cyber forensics, providing us with intriguing technical information on how such botnets in the wild are created, operated, and dismantled,” says ESET researcher Ivan Bešina, who investigated the disappearance of Mozi.

On September 27, 2023, ESET researchers spotted the control payload (configuration file) inside a UDP message missing the typical content; its new activity was in fact to act as the kill switch responsible for Mozi’s takedown. The kill switch stopped the parent process – the original Mozi malware – and disabled certain system services, replaced the original Mozi file with itself, executed certain router/device configuration commands, and disabled access to various ports.

Despite the drastic reduction in functionality, the Mozi bots have maintained persistence, indicating a deliberate and calculated takedown. ESET analysis of the kill switch showed a strong connection between the botnet’s original source code and recently used control payloads that were signed by the correct private keys.

“There are two potential instigators for this takedown: the original Mozi botnet creator or Chinese law enforcement, perhaps enlisting or forcing the cooperation of the original actor or actors. The sequential targeting of India and then China suggests that the takedown was carried out deliberately, with one country targeted first and the other a week later,” explains Bešina.

 

Vertiv Outlines Best Practices of High-Density Cooling for Data Centers

Vertiv Outlines Best Practices of High-Density Cooling for Data Centers

Mahmoud Abdelmoneim, Sales Director for Middle East, Turkey & Central…
How Generative AI Accelerates Digital Transformation

How Generative AI Accelerates Digital Transformation

Lori MacVittie, F5 Distinguished Engineer discusses the impact of…
Maintaining Balance Between Performance and User Experience

Maintaining Balance Between Performance and User Experience

Gaurav Mohan, VP, SAARC & Middle East, NETSCOUT, discusses that…
Microsoft reveals Top Three teams for Imagine Cup!

Microsoft reveals Top Three teams for Imagine Cup!

Today marks a pivotal moment in the 2024 Imagine Cup as Microsoft reveal…
OPPO collaborates with startups for tech advancements

OPPO collaborates with startups for tech advancements

Today, with 150 million startups worldwide and another 50…
TikTok awards women entrepreneurs in Riyadh

TikTok awards women entrepreneurs in Riyadh

TikTok MENA celebrated the conclusion of the second edition of…