Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities

In November, FortiGuard Labs observed a unique botnet written in the Go language being distributed through IoT vulnerabilities. This botnet, known as Zerobot, contains several modules, including self-replication, attacks for different protocols, and self-propagation. It also communicates with its command-and-control server using the WebSocket protocol.

REFERENCE: https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities

TAGS: zerobot, botnet campaign, websocket, linux, self-replication, spring4shell, phpadmin, f5big

MALWARE FAMILY: Zerobot

ATT&CK IDS: T1055 - Process Injection, T1205 - Traffic Signaling, T1406 - Obfuscated Files or Information, T1102 - Web Service, T1543 - Create or Modify System Process, T1053 - Scheduled Task/Job

Read More:

https://otx.alienvault.com/pulse/638fa082a8a32776822c2007