FICORA and CAPSAICIN Botnets Exploit Legacy D-Link Router Vulnerabilities

In late 2024, cybersecurity researchers observed a significant increase in activity from two botnets: the Mirai variant "FICORA" and the Kaiten variant "CAPSAICIN." Both botnets exploit known vulnerabilities in D-Link devices, particularly through the Home Network Administration Protocol (HNAP) interface, enabling remote command execution. The specific vulnerabilities targeted include CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.

FICORA Botnet

The "FICORA" botnet has been active across multiple countries, indicating a broad, non-targeted attack strategy. It employs a downloader script named "multi" to fetch malware compatible with various Linux architectures, including ARM, MIPS, PowerPC, and SPARC. The malware's configuration, encompassing its command-and-control (C2) server domain and a unique identifier, is encrypted using the ChaCha20 algorithm. Additionally, "FICORA" integrates brute-force attack functionality with hard-coded username and password lists, enabling it to compromise other devices. Its capabilities include launching distributed denial-of-service (DDoS) attacks utilizing UDP, TCP, and DNS protocols.

CAPSAICIN Botnet

In contrast, the "CAPSAICIN" botnet exhibited a brief but intense period of activity on October 21–22, 2024, primarily focusing on East Asian nations. It utilizes a downloader script ("bins.sh") to retrieve binaries targeting multiple Linux architectures. Once active, "CAPSAICIN" establishes a connection with its C2 server, transmitting the victim host's operating system information and awaiting further commands. Notably, it terminates processes associated with other known botnets to ensure it maintains exclusive control over the compromised device. Its functionalities include executing shell commands, downloading files, and performing various types of DDoS attacks.

Implications and Recommendations

The resurgence of these botnets underscores the persistent threat posed by outdated or unpatched IoT devices. Despite the availability of patches, the continued prevalence of these attacks highlights a broader issue of neglected firmware updates and device maintenance. To mitigate such risks, it is crucial for organizations and individuals to:

• Regularly update device firmware to address known vulnerabilities.
• Replace end-of-life devices that no longer receive security updates.
• Implement strong, unique passwords and disable unnecessary remote access features.
• Employ comprehensive network monitoring to detect and respond to unusual activities promptly.

Conclusion

The activities of the "FICORA" and "CAPSAICIN" botnets highlight the critical importance of maintaining up-to-date security measures for network devices. Proactive management of device firmware and configurations is essential to defend against the exploitation of known vulnerabilities by malicious actors.