GDT Webinar Series – How to Fail at Security? Reserve Your Spot

REAPER BOTNET: EXECUTE ORDER 66

by Moe Janmohammad via ScienceMoez.com

Almost exactly a year after the Mirai Botnet took down half of the internet, a new IoT botnet is building itself to launch an even more disruptive attack. On October 19th, CheckPoint announced they’ve started tracking a new botnet, named “Reaper”, which had already found its way into over 1 million organizations.

Unlike Mirai, which downloaded itself onto IoT devices using the default passwords, Reaper uses at least 9 known exploits to compromise the devices. Currently affected manufacturers include AVTECH, NetGear, Linksys, and D-Link, among others.
Both Mirai and Reaper are worms, which means they spread automatically from one device to another, so their calls back to a command and control server can be few and far between. Mirai’s scanning is extremely aggressive, often causing an unintentional Denial of Service attack on small home routers its trying to take control of. Reaper is different in that its’ scans are much less aggressive, and spreads very deliberately. This allows it to add devices to the botnet more stealthily and fly under the radar of security operations personnel looking for suspicious activity.

Hindsight is 20-20

Looking back at the 2016 Mirai attacks, researchers can see all of the telltale signs of an impending attack. Increased communication with unknown IPs, sudden processor usage increase, and unresponsive IoT devices were all signs that could have been used to detect the botnet before it’s attacks on Dyn’s servers. Since Reaper is moving much more slowly, its intentions are harder to guess. We already know that it has enough devices to recreate the 2016 Mirai attacks, with even greater power.
Some theories about the purpose of the Reaper Botnet include a giant distributed proxy network, or Tor endpoints to create more anonymized browsing resources. Some of the signs look like it’s going to mirror the Mirai attack, but other signs are completely new to us. It even lives harmoniously with Mirai on devices that have been compromised by both!

How do I protect my devices?

Almost all of the exploits being used to take over the devices are vulnerabilities discovered in the last 3 months. There is a very good chance that your IoT devices don’t have the updates required to patch those flaws. My advice is to patch often, turn on automatic updates, and check on your devices at least once a week. The Reaper code looks like its being updated, so new vulnerabilities can, and will, be exploited to take over your IoT devices.
For now, all we can do is wait in the calm before the storm.

Author

Share this article

You might also like:

NCAA basketball coaching legend Bobby Knight once said: “Good basketball always starts with a good defense.” Winning teams understand their opponents’ strengths and weaknesses, as well as their own. They study their opponents’ plays and anticipate their next moves. The same concept is true for cybersecurity, which is why, at

GDT is committed to supporting #WomenInTech. In this interview, Sr. Bid Manager Peggy Debrowski shares insights into her journey, challenges, and triumphs as a woman in the technology industry. From her role evolution to her passion for empowering women, Peggy’s narrative inspires and encourages aspiring professionals. Sydney: How long have

Welcome to our February edition of our GDT Employee Spotlight. Our Culture & Engagement Manager, Sydney Johnson, interviewed Anirudh Raghavan, Associate Solutions Architect, with our Professional Services team this month. SYDNEY: Hi, Anirudh! Thank you for taking the time to answer my questions for our February Employee Spotlight. You have