Security

New Mirai botnet species 'Okiru' hunts for ARC-based kit

Researchers: Code designed to hit Linux devices

By John Leyden

11 SHARE

A new variant of the notorious Mirai malware is exploiting kit with ARC processors.

The nasty, dubbed Okiru, is the first capable of infecting devices powered by ARC CPUs. This is according to Japan-based malware researcher UnixFreaxjp of the infosec group Malware Must Die.

RISC-based ARC embedded processors are used in a variety of internet-connected products including cars, mobiles, TVs, cameras and more. The discovery of malware capable of infecting such devices is troubling because of how much damage IoT botnets have caused in the past.

The Mirai botnet of 100,000 IoT devices wreaked havoc across the web in 2016 by taking down DNS services provider Dyn.

"There are likely more than 1.5 billion devices out there with ARC processors, enough to overwhelm the largest of networks," warned Barry Shteiman, director of threat research at security vendor Exabeam.

Researchers at Malware Must Die told El Reg: "The samples have been spotted in multiple places from several sources, some were spotted after infection, some are sitting in C2. For sure, ARC Linux devices are being targeted.

"The analysis of the code after decompilation shows the herders were preparing ARC binary specifically to target one particular Linux environment."

Malware Must Die said it was unable to give any estimate on how many devices had already been infected. ®

Sign up to our NewsletterGet IT in your inbox daily

11 Comments

More from The Register

Google Play Store spews malware onto 9 million 'Droids

How did these get through the net?

Cover your NASes: QNAP acknowledges mystery malware but there's no patch yet

Anti-antivirus root-rooting weirdness just gets deeper

Q. What connects the global financial crisis, Ursnif malware, and Coldplay's Viva la Vida?

A. Bad things from 2008 we can't seem to shake

Hadoop coop thrown for loop by malware snoop n' scoop troop? Oh poop

Attacks on distributed frameworks on the rise, it is claimed by infosec biz

Kwik-Fit hit by MOT fail, that's Malware On Target

Techies exhausted, customers deflated, management tyred... you can't get better

Windows 10 or Cisco Advanced Malware Protection: Pick one

Redmond warns that the malware tool doesn't play nice with the latest upgrade

Russian malware harvesting Telegram Desktop creds, chats

Python programmer may have outed himself on YouTube

FBI fingers North Korea for two malware strains

'Joanap' and 'Brambul' harvest info about your systems and send it home

Microsoft emergency update: Malware Engine needs, erm, malware protection

Stop appreciating the irony and go install the patch now

US-CERT warns of more North Korean malware

'Typeframe' springs from the same den as 'Hidden Cobra'