A Dasan Networks router similar to this one is under active exploit by the potent Satori botnet. (credit: Dasan Networks)
A fast-moving botnet that turns routers, cameras, and other types of Internet-connected devices into potent tools for theft and destruction has resurfaced again, this time by exploiting a critical vulnerability that gives attackers control over as many as 40,000 routers. Despite the high stakes, there’s no indication that the bug will be fixed anytime soon, if at all.
Satori, as the botnet has been dubbed, quickly made a name for itself in December, when it infected more than 100,000 routers in just 12 hours by exploiting critical vulnerabilities in two models, one made by Huawei and the other by RealTek. Last month, Satori operators released a new version that infected devices used to mine digital coins, a feat that allowed the attackers to mine as much as $3,000 worth of Etherium, based on prices the digital coin was commanding at the time.
In recent days, Satori has started infecting routers manufactured by Dasan Networks of South Korea. The number of daily infected routers is about 13,700, with about 82 percent of them located in Vietnam, a researcher from China-based Netlab 360 told Ars. Queries on the Shodan search index of Internet-connected devices show there are a total of more than 40,000 routers made by Dasan. The company has yet to respond to an advisory published in December that documented the code-execution vulnerability Satori is exploiting, making it possible that most or all of the devices will eventually become part of the botnet.