“Sticky, evolving botnet” gets top cyber experts worried about the future

A dangerous and potentially destructive new IoT malware sample has recently surfaced that for the first time this year is not just another cheap Mirai knockoff. And that in itself is saying something. Researchers from security vendor Avast recently analysed the said malware and have named it Torii because the telnet attacks through which it is being propagated have been coming from Tor exit nodes. Besides bearing little resemblance to Mirai, it’s destructive ancestor that a couple of years ago took down most of the US east coast and European internet, Torii is also much more stealthy, and crucially much more persistent and harder to remove when it compromises a device.

It is designed to infect what Avast says is one of the largest sets of devices and architectures for an IoT malware products and devices on which Torii works include those based on x86, x64, PowerPC, MIPS, ARM, and several other architectures. Which is pretty much everything…

Interestingly, so far at least, Torii is not being used to assemble DDoS botnets like Mirai was, or to drop cryptomining tools like some more recent variants have been doing. Instead it appears optimized for stealing data from IoT devices. And, like a slew of other recent malware, Torii makes increasingly great use of modular design, meaning it’s capable of relatively easily fetching and executing other commands that it can then add into its armoury.

Martin Hron, a security researcher at Avast says, if anything, Torii is more like the destructive VPNFilter malware that infected some 500,000 network attached storage devices and home-office routers this May. VPNFilter attacked network products from at least 12 major vendors and was capable of attacking not just routers and network attached storage devices but the systems behind them as well.

Despite that though Torii is different from other IoT malware programs for several reasons. For one thing, "it uses six or more ways to achieve persistence ensuring it doesn’t get kicked out of the device easily on a reboot or by another piece of malware," Hron notes, and when he talks about being kicked out by another malware he’s talking about the equally revolutionary, but apparently saintly, Fbot malware which was also discovered this month, and that unlike its malicious cousins actually does good by finding them and removing them. A truly saintly piece of software if ever there was one…

Torii's modular, multistage architecture is different too.

"It drops a payload to connect with [command-and-control (CnC)] and then lays in wait to receive commands or files from the CnC," the security researcher says. The command-and-control server with which the observed samples of Torii have been communicating is located in Arizona.

Torii's support for a large number of common architectures gives it the ability to infect anything with open telnet, which includes millions of IoT devices. Worryingly, it is likely the malware authors have other attack vectors as well, but telnet is the only vector that has been used so far, Hron notes.

While Torii hasn't been used for DDoS attacks yet, it has been sending a lot of information back to its command-and-control server about the devices it has infected. The data being exfiltrated includes Hostname, Process ID, and other machine-specific information that would let the malware operator fingerprint and catalog devices more easily. Hron says Avast researchers aren't really sure why Torii is collecting all the data.

Significantly, Avast researchers discovered a hitherto unused binary on the server that is distributing the malware, which could let the attackers execute any command on an infected device. The app is written in GO, which means it can be easily recompiled to run on virtually any machine.

Hron says Avast is unsure what the malware authors plan to do with the functionality. But based on its versatility and presence on the malware distribution server, he thinks it could be a backdoor or a service that would let the attacker orchestrate multiple devices at once.

The log data that Avast was able to analyze showed that slightly less than 600 unique client devices had downloaded Torii. But it is likely that the number is just a snapshot of new machines that were recruited into the botnet for the period for which Avast has the log files, the security vendor said.