Based upon the Mirai botnet, a new botnet has emerged onto the digital landscape in the form of InfectedSlurs, and it’s helping to fuel DDoS attacks.
Once again, the cause of infection behind InfectedSlurs attack are a number of zero-day vulnerabilities. These vulnerabilities – now identified as CVE-2023-49897 and CVE-2023-47565 – allowed InfectedSlurs to compromise both a series of WiFi routers and a QNAP network video recorder. The potential for data loss here is huge, but InfectedSlurs also makes sure that it hijacks infected devices and integrates them into a huge DDoS swarm.
The InfectedSlurs Attack
It’s believed that the attack by InfectedSlurs involved vulnerabilities which should have been addressed by firmware updates released several years ago. However, many organizations appear to still be using legacy versions of the QNAP software. And this is what’s allowed them to be compromised. It’s also been revealed that InfectedSlurs has been running in the digital wild since late 2022, so it’s had close to a year to take advantage of legacy versions.
A security patch was launched at the start of December 2023, to provide the strongest possible protection, and users were told to perform a factory reset alongside a password change. Users have also been advised to initiate a firmware update, found within the network video recorder settings, to ensure they have the latest and most secure version in place. Again, it’s been recommended that all passwords and access privileges are verified.
However, for the older, legacy devices which are in their end-of-life phase, there will be no further firmware updates released. In these instances, users have no alternative but to replace their devices with the latest models, which will be fully patched against all known threats.
How Can You Prevent These Attacks?
There are two big takeaways from the InfectedSlurs attack:
- Always install software updates as soon as possible
- Replace legacy devices when they have reached their end-of-life phase
Both these points are easy to implement, but the evidence of the InfectedSlurs attack proves this is not always undertaken by organizations. However, to protect the security of your IT infrastructure, it’s crucial that this is given priority.
InfectedSlurs was also able to execute its attack for close to a year without being detected, so what else should you be looking out for? Well, the following signs may indicate that you have fallen victim to an attack:
- Slow performance: one of the telltale signs of being involved in a DDoS attack is a drop in performance from the infected PC. This is because all the processing power is diverted away from the PC’s day-to-day operations and dedicated to supporting the DDoS attack. Therefore, if your PCs are running slow, and you can’t pinpoint the cause to hardware issues, there’s a chance they may have become involved in a DDoS attack.
- Unusual server patterns: if your PCs have been integrated into a DDoS swarm, it’s likely this will result in abnormal spikes in traffic related to your server. This is because DDoS attacks usually involve high volumes of traffic from multiple sources at once. So, if your server logs indicate behavior such as this, it’s important you investigate immediately to identify if the cause is known.
For more ways to secure and optimize your business technology, contact your local IT professionals.
