Muhstik Botnet Exploiting Apache RocketMQ Flaw to Broaden DDoS Assaults

Jun 06, 2024NewsroomBotnet / DDoS Assault

Muhstik Botnet

The distributed denial-of-service (DDoS) botnet generally known as Muhstik has been noticed leveraging a now-patched safety flaw impacting Apache RocketMQ to co-opt vulnerable servers and increase its scale.

“Muhstik is a well known risk focusing on IoT units and Linux-based servers, infamous for its capability to contaminate units and make the most of them for cryptocurrency mining and launching Distributed Denial of Service (DDoS) assaults,” Cloud safety agency Aqua said in a report revealed this week.

First documented in 2018, assault campaigns involving the malware have a historical past of exploiting identified safety flaws, particularly these referring to net functions, for propagation.

The newest addition to the checklist of exploited vulnerabilities is CVE-2023-33246 (CVSS rating: 9.8), a critical security flaw affecting Apache RocketMQ that enables a distant and unauthenticated attacker to carry out distant code execution by forging the RocketMQ protocol content material or utilizing the replace configuration perform.


As soon as the shortcoming is efficiently abused to acquire preliminary entry, the risk actor proceeds to execute a shell script hosted on a distant IP tackle, which is then answerable for retrieving the Muhstik binary (“pty3”) from one other server.

“After gaining the power to add the malicious payload by exploiting the RocketMQ vulnerability, the attacker is ready to execute their malicious code, which downloads the Muhstik malware,” safety researcher Nitzan Yaakov mentioned.

Persistence on the host is achieved by the use of copying the malware binary to a number of directories and modifying the /and so on/inittab file — which controls what processes to begin through the booting of a Linux server — to mechanically restart the method.

What’s extra, the naming of the binary as “pty3” is probably going an try to masquerade as a pseudoterminal (“pty“) and evade detection. One other evasion method is that the malware is copied to directories akin to /dev/shm, /var/tmp, /run/lock, and /run through the persistence part, which permits it to be executed immediately from reminiscence and keep away from leaving traces on the system.

Muhstik comes outfitted with options to assemble system metadata, laterally transfer to different units over a safe shell (SSH), and in the end set up contact with a command-and-control (C2) area to obtain additional directions utilizing the Web Relay Chat (IRC) protocol.

The top purpose of the malware is to weaponize the compromised units to carry out various kinds of flooding assaults towards targets of curiosity, successfully overwhelming their community sources and triggering a denial-of-service situation.

With 5,216 susceptible cases of Apache RocketMQ nonetheless uncovered to the web after greater than a yr of public disclosure of the flaw, it is important that organizations take steps to replace to the most recent model with the intention to mitigate potential threats.


“Furthermore, in earlier campaigns, cryptomining exercise was detected after the execution of the Muhstik malware,” Yaakov mentioned. “These aims go hand in hand, because the attackers try to unfold and infect extra machines, which helps them of their mission to mine extra cryptocurrency utilizing {the electrical} energy of the compromised machines.”

The disclosure comes because the AhnLab Safety Intelligence Middle (ASEC) revealed that poorly secured MS-SQL servers are being focused by risk actors to varied kinds of malware, starting from ransomware and distant entry trojans to Proxyware.

“Directors should use passwords which are tough to guess for his or her accounts and alter them periodically to guard the database server from brute-force assaults and dictionary assaults,” ASEC said. “They need to additionally apply the most recent patches to forestall vulnerability assaults.”

Discovered this text attention-grabbing? Comply with us on Twitter and LinkedIn to learn extra unique content material we submit.