Trellix Insights: Mirai_ptea_Rimasuta botnet actively exploiting RUIJIE NBR700 routers 0-day

Technical Articles ID: KB95192
Last Modified: 2022-09-05 09:26:46 Etc/GMT

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by Trellix Insights technology. The content is intended for use by Trellix Insights users, but is provided for general knowledge to all customers. Contact us for more information about Trellix Insights.

Summary

Description of Campaign
Mirai_ptea_Rimasuta (also known as Mirai_ptea) was first identified in mid-2021 and so named for the use of the Tor Proxy for C2 communication and the use of Tiny Encryption Algorithm to hide resource information. It's a variant of the Marai botnet and is a result of the Marai source code being made publicly available in 2016, which has spawned different variants that threat actors use today. In recent events involving this new variant, a 0-day vulnerability in the NBR700-series routers produced by Ruijie have been targeted by the botnet operators. This 0-day vulnerability is exploitable because of an interface that accepts URLs passed in from the page for wget testing but it doesn't perform special character checks, which might lead to command injection.

Our Threat Research team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by NetLab 360 and shared publicly.

How to use this article:

Scroll down and review the Product Countermeasures section of this article. Consider implementing them if they are not already in place.
Review the following articles:
- KB87843 - Dynamic Application Containment rules and best practices
- KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check Trellix Insights for the latest IOCs.

Campaign IOC

Type	Value
URL	http://2.56.244.121/tuPuSSbAxXIW
URL	http://2.56.244.121/gkTHLPZAAsmP
URL	http://2.56.244.121/VqIXrFxAGpPD
URL	http://2.56.244.157/qSdYKoxbZakW
URL	http://2.56.244.157/iZXPWXshhRRt
URL	http://2.56.244.157/vnlWcwcBunwk
URL	http://2.56.244.157/IAqecfTrQwQF
URL	http://2.56.244.157/bwgFHtUOGJcv
URL	http://2.56.244.121/KaoJHwKMBiAJ
URL	http://2.56.244.157/yhZyIAclbmhD
URL	http://2.56.244.157/PszBtRNfnzBO
URL	http://2.56.244.157/SywXQrWdNIrM
URL	http://2.56.244.157/awfLWTOmgxTX
URL	http://2.56.244.157/zEkFejmPQeVR
URL	http://91.211.91.56/mIoCinspKSkE
URL	http://91.211.89.242/vkvTxquhFCGV
URL	http://91.211.88.220/OOGRLHgUnshR

Minimum set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 5 Use GTI URL reputation to identify trusted or malicious processes

Affected Products

Trellix insights

Knowledge Center

Trellix Insights: Mirai_ptea_Rimasuta botnet actively exploiting RUIJIE NBR700 routers 0-day

Environment

Summary

Affected Products

Title

Title

Knowledge Center

Trellix Insights: Mirai_ptea_Rimasuta botnet actively exploiting RUIJIE NBR700 routers 0-day

Environment

Summary

Affected Products

Choose your region

Title

Title