Ankura CTIX FLASH Update - January 31, 2025

Malware Activity

Emerging Cyber Threats: Mirai Botnet, Apple Silicon Vulnerabilities, and ChatGPT Exploit

A Mirai botnet variant called Aquabot has been observed exploiting a medium-severity security flaw (CVE-2024-41710) in Mitel phones to recruit them into a network capable of launching distributed denial-of-service (DDoS) attacks. The vulnerability allows an authenticated attacker to execute arbitrary commands due to insufficient parameter sanitization, and Aquabot using a proof-of-concept (PoC) exploit to target the vulnerability, requires authentication and brute-forcing to gain initial access, after which the malware downloads and installs an Aquabot payload, sets up persistence, and connects to its command-and-control (C2) server to receive instructions. The goal of Aquabot is to enlist devices in a DDoS swarm, which is advertised on Telegram as a testing tool for DDoS mitigation measures, but is suspected to be offered as a DDoS service, and has been