Article Details
Scrape Timestamp (UTC): 2023-11-01 17:25:33.771
Original Article Text
Click to Toggle View
Mozi malware botnet goes dark after mysterious use of kill-switch. Mozi malware botnet activity faded away in August after a mysterious unknown party sent a payload on September 27, 2023, that triggered a kill switch to deactivate all bots. Mozi is a well-known DDoS (distributed denial of service) malware botnet that emerged in 2019, primarily targeting IoT devices such as routers, digital video recorders, and other internet-connected gadgets. The malware leveraged known vulnerabilities or weak default passwords to compromise devices and make them part of its decentralized peer-to-peer network, where they communicate using BitTorrent's DHT (distributed hash table) protocol. Mozi mysteriously killed Today, ESET reported that its telemetry data showed a sharp drop in Mozi activity on August 8, 2023, starting with a halt to all operations in India. This was followed by a similar sudden termination of activities in China, where the botnet originates, on August 16, 2023. Finally, on September 27, 2023, a UDP message was sent to all Mozi bots eight times instructing them to download an update via HTTP, which caused the following: The fact that whoever pressed the kill switch opted to maintain persistence for the new payload, which can also ping a remote server to assist in tracking, implies a controlled takedown. ESET's code analysis showed strong similarities between the original Mozi code and the binaries used in the takedown, which featured the correct private keys for signing the payload. This hints at the involvement of either the original botnet creators and/or Chinese law enforcement in the takedown, but for now, this remains unanswered. Despite the good news of one of the most prolific botnets going offline, there are, unfortunately, many more DDoS malware botnets scanning the web daily for vulnerable IoTs. Therefore, users should patch their devices using the latest firmware version, use strong passwords, and isolate them from critical networks.
Daily Brief Summary
The Mozi malware botnet was deactivated after an unknown party sent a payload that triggered a deactivation on 27th September 2023.
The botnet, which targeted IoT devices for DDoS attacks, suddenly saw a drop in activity in August 2023, starting with operations in India being halted.
This cessation of activity was followed by a similar halt in China, where the botnet originates.
On 27th September 2023, a UDP message was sent to all Mozi bots instructing them to download an update via HTTP, which deactivated the network.
Analysis of the code used in the deactivation indicates it was similar to the original Mozi code and included the correct private keys for signing the payload, suggesting involvement of either the original botnet creators or Chinese law enforcement in the takedown.
Despite one of the most prolific botnets becoming inactive, there are still many other DDoS malware botnets actively seeking vulnerable IoTs, therefore users are urged to protect their devices with the most recent software updates, strong passwords, and by isolating them from critical networks.