New Mirai botnet species 'Okiru' hunts for ARC-based kit

Researchers: Code designed to hit Linux devices

Penguins line up to dive into the icy water from the ice floe.

A new variant of the notorious Mirai malware is exploiting kit with ARC processors.

The nasty, dubbed Okiru, is the first capable of infecting devices powered by ARC CPUs. This is according to Japan-based malware researcher UnixFreaxjp of the infosec group Malware Must Die.

RISC-based ARC embedded processors are used in a variety of internet-connected products including cars, mobiles, TVs, cameras and more. The discovery of malware capable of infecting such devices is troubling because of how much damage IoT botnets have caused in the past.

The Mirai botnet of 100,000 IoT devices wreaked havoc across the web in 2016 by taking down DNS services provider Dyn.

"There are likely more than 1.5 billion devices out there with ARC processors, enough to overwhelm the largest of networks," warned Barry Shteiman, director of threat research at security vendor Exabeam.

Researchers at Malware Must Die told El Reg: "The samples have been spotted in multiple places from several sources, some were spotted after infection, some are sitting in C2. For sure, ARC Linux devices are being targeted.

"The analysis of the code after decompilation shows the herders were preparing ARC binary specifically to target one particular Linux environment."

Malware Must Die said it was unable to give any estimate on how many devices had already been infected. ®




Biting the hand that feeds IT © 1998–2018