Security

New Mirai botnet species 'Okiru' hunts for ARC-based kit

Researchers: Code designed to hit Linux devices

By John Leyden

11 SHARE

A new variant of the notorious Mirai malware is exploiting kit with ARC processors.

The nasty, dubbed Okiru, is the first capable of infecting devices powered by ARC CPUs. This is according to Japan-based malware researcher UnixFreaxjp of the infosec group Malware Must Die.

RISC-based ARC embedded processors are used in a variety of internet-connected products including cars, mobiles, TVs, cameras and more. The discovery of malware capable of infecting such devices is troubling because of how much damage IoT botnets have caused in the past.

The Mirai botnet of 100,000 IoT devices wreaked havoc across the web in 2016 by taking down DNS services provider Dyn.

"There are likely more than 1.5 billion devices out there with ARC processors, enough to overwhelm the largest of networks," warned Barry Shteiman, director of threat research at security vendor Exabeam.

Researchers at Malware Must Die told El Reg: "The samples have been spotted in multiple places from several sources, some were spotted after infection, some are sitting in C2. For sure, ARC Linux devices are being targeted.

"The analysis of the code after decompilation shows the herders were preparing ARC binary specifically to target one particular Linux environment."

Malware Must Die said it was unable to give any estimate on how many devices had already been infected. ®

Sign up to our NewsletterGet IT in your inbox daily

11 Comments

More from The Register

Russian malware harvesting Telegram Desktop creds, chats

Python programmer may have outed himself on YouTube

FBI fingers North Korea for two malware strains

'Joanap' and 'Brambul' harvest info about your systems and send it home

US-CERT warns of more North Korean malware

'Typeframe' springs from the same den as 'Hidden Cobra'

Advanced VPNFilter malware menacing routers worldwide

Cisco's Talos team says 500k already pwned and leaking data

Microsoft emergency update: Malware Engine needs, erm, malware protection

Stop appreciating the irony and go install the patch now

DOJ convicts second bloke for helping malware go undetected

Scan scam? Scram

Worker perks flinger Sodexo pulls Engage website after malware smackdown

UK information commish is investigating

Malware-slinging scum copied D-Link's code-signing certificates to dress up PC nasties

Password-stealing backdoor lobbed at Windows boxes

Who needs custom malware? 'Govt-backed' Gallmaker spy crew uses off-the-shelf wares

Likely state hackers make do with 'living off the land' and going after tardy Office patchers

Fancy Bear still Putin out new modules for VPNFilter malware

Talos turns up obfuscation, lateral attacks, and proxies