People’s Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations

Technical details

Attribution

Integrity Technology Group (Integrity Tech) is a company based in the PRC with links to the PRC government. Integrity Tech has used China Unicom Beijing Province Network IP addresses to control and manage the botnet described in this advisory.

In addition to managing the botnet, these same China Unicom Beijing Province Network IP addresses were used to access other operational infrastructure employed in computer intrusion activities against U.S. victims. FBI has engaged with multiple U.S. victims of these computer intrusions and found activity consistent with the tactics, techniques, and infrastructure associated with the cyber threat group known publicly as Flax Typhoon, RedJuliett, and Ethereal Panda.

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and these may not be a 1:1 correlation to the U.S. Government’s methodology and understanding for all activity related to these groupings.

Botnet command and control

As with similar botnets, this botnet infrastructure is comprised of a network of devices, known as “bots”, which are infected with a type of malware that provides threat actors with unauthorized remote access. A functioning botnet can be used for a variety of purposes, including malware delivery, distributed denial of service (DDoS) attacks, or routing nefarious Internet traffic.

The botnet uses the Mirai family of malware, designed to hijack IoT devices such as webcams, DVRs, IP cameras, and routers running Linux-based operating systems. The Mirai source code was posted publicly on the Internet in 2016, resulting in other hackers creating their own botnets based on the malware. Since that time, various Mirai botnets have been used to conduct DDoS and other malicious activities against victim entities within the United States.

The investigated botnet's customized Mirai malware is a component of a system that automates the compromise of a variety of devices. To recruit a new "bot," the botnet system first compromises an Internet-connected device using one of a variety of known vulnerability exploits (see Appendix B: Observed CVEs). Post-compromise, the victim device executes a Mirai-based malware payload from a remote server. Once executed, the payload starts processes on the device to establish a connection with a command-and-control (C2) server using Transport Layer Security (TLS) on port 443. The processes gather system information from the infected device, including but not limited to the operating system version and processor, memory and bandwidth details to send to the C2 server for enumeration purposes. The malware also makes requests to "c.speedtest.net," likely to gather additional Internet connection details. Some malware payloads were self-deleting to evade detection.

A variety of subdomains of "w8510.com" were linked to the botnet's C2 servers. As of September 2024, investigators identified over 80 subdomains associated with w8510.com (see Appendix A: Indicators of Compromise).

Botnet management

A tier of upstream management servers using TCP port 34125 manage the botnet's C2 servers. These management servers host a MySQL database which stored information used for the control of the botnet. As of June 2024, this database contained over 1.2 million records of compromised devices, including over 385,000 unique U.S. victim devices, both previously and actively exploited.

The management servers hosted an application known as “Sparrow” which allows users to interact with the botnet. The actors used specific IP addresses registered to China Unicom Beijing Province Network to access this application, including the same IP addresses previously used by Flax Typhoon to access the systems used in computer intrusion activities against U.S.-based victims.

The code for the Sparrow application, stored within a Git repository, defines functions that allow registered users to manage and control the botnet and C2 servers, sending tasks to victim devices including DDoS and exploitation commands to grow the botnet. Sparrow also contains functionality providing device vulnerability information to users. A subcomponent called "vulnerability arsenal" also allows users to exploit traditional computer networks through the victim devices in the botnet.

Compromised device distribution

The following tables approximate the count of devices compromised by the botnet system as of June 2024, by location and by processor architecture. There were at least 50 different Linux operating system versions found among botnet nodes. Based on the operating system versions of the nodes, infected systems include devices that ceased receiving support as early as 2016 to devices that are currently supported. Affected devices were running Linux kernel versions 2.6 through 5.4.

Recommended mitigations

The FBI recommends network defenders take the following actions to mitigate threats posed by adversaries attempting to use botnets for malicious cyber activity. The following guidance applies both to preventing IoT devices from becoming part of a botnet, as well as to defending networks from botnets already in operation.

• Disable unused services and ports such as automatic configuration, remote access or file sharing protocols. Routers and IoT devices may provide features such as Universal Plug and Play (UPnP), remote management options and file sharing services, which threat actors may abuse to gain initial access or to spread malware to other networked devices. Disable these features if not needed.
• Implement network segmentation to ensure IoT devices within a larger network pose known, limited, and tolerable risks. Use the principle of least privilege to provide devices with just enough connectivity needed to perform their intended function.
• Monitor for high network traffic volume. Since DDoS attacks originating from botnets may at first appear similar to normal traffic, it is critical for organizations to define, monitor and prepare for abnormal traffic volumes. Monitoring is possible via firewalls or intrusion detection systems. Some network solutions such as proxies may mitigate DDoS incidents.
• Apply patches and updates, including software and firmware updates. Regular patching mitigates many high-risk security vulnerabilities. If available, take advantage of automatic update channels from trusted network locations. Do not trust email messages claiming to provide software updates as attachments or via links to untrusted websites.
• Replace default passwords with strong passwords. Many IoT products implement a device administration password in addition to other account passwords. Ensure all passwords are changed from their defaults, using a strong password policy. If possible, disable password hints.
• Plan for device reboots. Rebooting a device terminates all running processes, which may remove specific types of malware, such as "fileless" malware that runs in the host’s memory. As a reboot may disrupt legitimate activity, users may need to prepare for service interruptions. Some devices provide scheduled reboot features, enabling reboots to occur at preferred times. If a compromised device fails to respond to reboot commands issued remotely, reboot physically.
• Replace end-of-life equipment with devices that remain in respective vendor support plans.

Disclaimer

The information in this report is being provided "as is" for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the authoring organizations.

Appendix A: Indicators of compromise

The following listed domain names were observed subdomains of "w8510.com", the observed command-and-control system domain.

Appendix B: Observed CVEs

Integrity Tech relied on the following vulnerabilities to acquire new botnet victims and allow botnet users to exploit further victims through the compromised botnet devices.