Deploying Mirai Botnet Malware via a Spring4Shell Vulnerability

Since the beginning of April 2022, threat actors have been actively exploiting the critical Spring4Shell vulnerability to execute the Mirai botnet malware. This is especially true in the Singapore region.

Threat actors can download the Mirai sample to '/tmp' and run it after changing the permissions using 'chmod'," according to the report. In a report released on Friday, Trend Micro researchers Deep Patel, Nitesh Surana, and Ashish Verma said.

CVE-2022-22965 (CVSS score: 9.8) is a remote code execution vulnerability in Spring Core applications that could be exploited by malicious actors to gain complete control over compromised devices.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Spring4Shell vulnerability to its Known Exploited Vulnerabilities Catalog earlier this week based on "evidence of active exploitation," according to a statement from the agency.

In the past, botnet operators have been quick to add new flaws to their arsenal of exploits. The Log4Shell vulnerability was exploited by multiple botnets, including Mirai and Kinsing, in December 2021 to gain access to vulnerable servers on the internet.

When a Linux malware known as Mirai, which means "future" in Japanese, attacks networked smart home devices, it links them together into an infected network known as a botnet.

This herd of hijacked devices can then be used to carry out additional attacks, including large-scale phishing campaigns, cryptocurrency mining, and click fraud.

Since the leak of Mirai's source code in October 2016, numerous variants of the threat have been created, including Okiru, Satori, and Masuta.

An early report from cybersecurity firm CrowdStrike found a 35% increase in malware targeting Linux systems compared with 2020, with more than 22% of the malware observed in the year coming from XOR, Mirai, and Mozi malware families.

DDoS attacks use botnets made up of compromised internet-connected devices, which the researchers say is the primary purpose of the malware families in question.