Satori botnet is back again, experts observed a surge in port scan activity associated with it
17.6.2018 securityaffairs BotNet

This week, security experts observed a surge in port 8000 scan activity, researchers at Qihoo 360 Netlab determined that the unusual activity was associated with Satori IoT botnet.
Experts from Qihoo 360 Netlab discovered that the author of the Satori botnet have integrated a the proof-of-concept (PoC) code for the XionMai web server software package after it was published on June 8.

The code recently included in the Satori botnet exploits a buffer overflow vulnerability, tracked as CVE-2018-10088, in XionMai uc-httpd 1.0.0. The exploit could be used by remote attackers to execute arbitrary code by sending a malformed package via ports 80 or 8000.

“Two days ago, on 2018-06-14, we noticed that an updated Satori botnet began to perform network wide scan looking for uc–httpd 1.0.0 devices.” reads the report published by Qihoo 360 Netlab.

“Most likely for the vulnerability of XiongMai uc–httpd 1.0.0 (CVE-2018-10088). The scanning activities led to a surge in scanning traffic on ports 80 and 8000.”

Satori botnet scan-on-port-80

Satori botnet scan-on-port-8000

The lightweight web server package XionMai is often included in the firmware of many IoT devices from Chinese vendors.

Data collected by honeypots used by Qihoo 360 Netlab and SANS ISC confirms the Satori authors also included a second exploit, it allows the bot to target D-Link DSL-2750B devices.

The experts observed port 8000 scans drop down on June 15, the attackers started exploiting the PoC code against D-Link DSL-2750B routers exploited via ports 80 and 8080.

Satori botnet scan on port 8080

The experts started seeing a surge in scans for the above ports, instead of port 8000 associated with XionMai.

Data collected by security experts demonstrate the evolution of the Satori botnet, its author continues to include new exploit to make the botnet resilient to the takedown of law enforcement and security firm.

Further details, including Indicators of compromise (IoCs) for the Satori botnet are available in Qihoo 360 Netlab report.