Blog

Threat Finds

Mirai malware infects CCTV camera

Mirai malware infects CCTV cameraDefault blog imageDefault blog image
30
Jun 2020
30
Jun 2020

Executive summary

  • Recently, Darktrace detected an attack targeting an Internet connected camera commonly used in CCTV surveillance. This attack is a variant of the Mirai malware, an old threat that is still used to target IoT devices.
  • IoT devices, such as Internet-connected cameras, are becoming common in personal and business environments. However, threats targeting IoT are difficult to detect and often go unnoticed since these devices effortlessly connect to digital infrastructure. This results in a greatly increased attack surface for businesses.
  • Attackers know that security for IoT devices is often severely lacking and continue to target these vulnerable devices.
  • Since traditional methods of antivirus and other legacy security approaches are powerless on IoT devices, Darktrace’s Cyber AI Platform fills the gap in protecting these essential appliances.

Introduction

In late May, Darktrace detected the Mirai malware infecting an Internet-facing DVR camera owned by a logistics company in Canada. Mirai, first discovered in 2016, continuously scans the Internet for the IP addresses of vulnerable devices in the Internet of Things (IoT), and then turns these devices into bots that can be used as part of botnets for large-scale network attacks.

By drawing on a bespoke, evolving understanding of what is normal for the network, Darktrace caught each stage in this attack’s lifecycle. However, because this company was still conducting their 30-day Proof of Value, Antigena was not in active mode and the attack continued past the point of initial compromise. Had Antigena been in active mode, the attack would not have advanced past initial compromise.

Timeline

Figure 1: This timeline roughly outlines the major attack phases over three days of activity

Technical analysis

At the time of the initial breach, this specific botnet’s infrastructure was not yet known to open source intelligence (OSINT). Darktrace, however, detected an EXE download from a location not previously visited by the network.

After the first anomalous EXE download, another was downloaded approximately twenty minutes later. The malware then reached out to multiple IP addresses that were statistically rare for the network. Specifically, the compromised device began transferring large amounts of data to an IP address in China.

Figure 2: An overview of Darktrace detections

Darktrace, by leveraging machine learning algorithms in a protocol agnostic capacity, analyzed this individual device’s transfers within the context of a continuously evolving understanding of what is normal both for this device and for the wider organization. It was therefore able to immediately flag all of these transfers as unusual.

This activity was fully investigated and reported on by Darktrace’s Cyber AI Analyst. A sample of the AI Analyst’s report is shown below. The Suspicious File Download, the Unusual Repeated Connections, and the Unusual External Data Transfer are all presented as unexpected events that call for further investigation. The destination IP of the suspicious download was determined to have 100% hostname rarity relative to what is normal for the organization.

Figure 3: Darktrace’s Cyber AI Analyst autonomously triages the attack

Moreover, the hash of the file, highlighted in a red box in the figure above, revealed that it was a well-known file related to the Mirai Botnet. However, with no antivirus or other security defending the IoT camera, this had gone undetected.

A one-click analysis of the infected device shows a timeline of the model breaches that occurred and graphs the activity to give the report’s readers a quick understanding of the successive stages of the attack. Here, we see the second and third stages of the attack’s lifecycle, in which it starts DDoS against other devices in order to complete its mission while simultaneously continuing outgoing connections to rare destinations in order to sustain its presence.

Figure 4: The device event log showing the list of model breaches on May 23

Conclusion

Interestingly, the client saw no indicators of this activity beyond a sluggish network. This change in network activity was only explained after being identified by Darktrace. Once the client was promptly notified, the compromise was deescalated, and discovering it was a DVR security camera, the client took the device offline.

As this customer was still concluding their trial deployment, Antigena was not in full autonomous mode. However, if it had been, Antigena would have responded with a two-tiered action to prevent the device from communicating with the malicious endpoint, cutting the compromised connection before the attack had gained its foothold.

Learn more about Darktrace Antigena

IoCs:

IoCComment37.49.226[.]246Camera seen downloading software from rare destination117.27.239[.]28Camera seen sending data to a new external device37.49.226[.]246, 43.227.220[.]153, 43.248.188[.]28Camera has been detected breaching multiple models within a single hour216.146.43[.]70, 216.146.43[.]71Camera making connections to command and control infrastructure related to dyndns[.]org

Darktrace model breaches:

  • Anomalous Connection / Uncommon 1GiB Outbound
  • Unusual Activity / Unusual External Activity
  • Unusual Activity / Enhanced Unusual External Data Transfer
  • Unusual Activity / Unusual External Data to New IPs
  • Device / Initial Breach Chain Compromise
  • Anomalous Server Activity / Outgoing from Server
  • Anomalous Connection / Data Sent to New External Device
  • Anomalous Connection / Multiple Connections to New External UDP Port
  • Anomalous Connection / Data Sent to Rare Domain
  • Anomalous File / EXE from Rare External Location
  • Anomalous File / Internet Facing System File Download

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Max Heinemeyer
Chief Product Officer

Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max oversees global threat hunting efforts, working with strategic customers to investigate and respond to cyber-threats. He works closely with the R&D team at Darktrace’s Cambridge UK headquarters, leading research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. When living in Germany, he was an active member of the Chaos Computer Club. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

USE CASES
No items found.
PRODUCT SPOTLIGHT
No items found.
COre coverage
No items found.

Related Articles

No items found.

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.