This devious botnet tried a trial run during the recent AWS outage – so when will it be back?

• ShadowV2, a Mirai-based cloud-native botnet, appeared briefly during an AWS outage
• It targeted IoT devices via multiple vendor vulnerabilities, likely as a test run
• Found across 20+ countries, ShadowV2 may return, echoing Mirai’s disruptive DDoS legacy

Another botnet built on the foundations of the infamous Mirai has been recently spotted in the wild, but only briefly – suggesting it might be preparing for a major attack.

Security researchers from FortiGuard Labs claim to have seen a new botnet named ShadowV2 which was active only during the recent AWS outage, meaning it was ‘alive’ for no more than 15 hours.

During that time, it targeted multiple vulnerabilities from multiple manufacturers (DD-WRT, D-Link, DigiEver, TBK, and TP-Link) and created a network of assimilated routers, Wi-Fi access points, NAS boxes, DVRs, network video recorders, and similar Internet of Things (IoT) hardware.

Best picks for you

Evolution of Mirai

The botnet could have been used the same way Mirai was used – to launch Distributed Denial of Service (DDoS) attacks, scan the internet for vulnerable devices, brute-force their credentials, infect them, and use them for further propagation.

FortiGuard Labs believes its emergence only served as a “test run”, and that the botnet will likely return in the future.

ShadowV2 is a cloud-native botnet that previously only targeted AWS EC2 instances. However, it has since evolved to target multiple industries, including technology, retail, hospitality, government, telecommunications, and more. It was found in more than two dozen countries around the world, including Canada, the US, UK, China, Russia, Saudi Arabia, and many others.

So far, there is no word on how many devices are infected with ShadowV2, or if the botnet is growing right now. We do know that it’s built primarily for IoT devices.

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Shortly after ShadowV2’s test run, Azure was hit with the “largest-ever” cloud-based DDOS attack, carried out by the Aisuru botnet – which is also considered a “descendent” of Mirai and is sometimes described as “Turbo Mirai”.

Mirai is often referred to as a “groundbreaking IoT malware” that became infamous for creating some of the largest and most disruptive botnets ever, knocking major websites and internet infrastructure offline worldwide.

Via The Register

The best antivirus for all budgets

Our top picks, based on real-world testing and comparisons

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!