- The FBI warned about the existence of new HiatusRAT malware
- The malware can take over devices and grant remote access
- Hackers are also targeting government agencies with it
A new Remote Access Trojan (RAT) malware has been detected targeting Chinese-branded web cameras and DVRs used in Western companies.
HiatusRAT, and it allows threat actors to “take over and control a targeted device from a distance”, says the FBI, which released a new Private Industry Notification (PIN) warning Hiatus’ operatives most likely kicked off their campaign in July 2022, and were looking to spy on US government organizations.
“Cybersecurity companies have also observed these actors using the malware to target a range of Taiwan-based organizations and to carry out reconnaissance against a US government server used for submitting and retrieving defense contract proposals,” the PIN says.
DVRs and web cams
The PIN noted the attackers were especially targeting web cameras and DVRs with known vulnerabilities, especially those who reached end-of-life, and those whose vendors are yet to patch the flaws.
Xiongmai and Hikvision were some of the names mentioned in the PIN, although the wording suggests that there are more vendors whose equipment is being targeted.
The FBI also said HiatusRAT scanned for IoT devices in the US, Australia, Canada, New Zealand, and the UK, for flaws including CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044, CVE-2021-36260. The crooks were also looking for devices with weak vendor-supplied passwords.
To run the scans, the attackers apparently used off-the-shelf, open-source software: “They used Ingram — a webcam-scanning tool available on Github — to conduct scanning activity,” the FBI said. “And they used Medusa — an open-source brute-force authentication cracking tool — to target Hikvision cameras with telnet access. Targeted TCP ports have included: 23, 26, 554, 2323, 567, 5523, 8080, 9530, and 56575.”
Leave a comment