POST /_async/AsyncResponseService HTTP/1.1 The request uses the path /install.php since it is the Webuzo installer file and by default a server running Webuzo will respond successfully to that request. To accomplish the scanning, it sends a GET request to port 2004/tcp, which is WebuzoвЂ™s default port for administration. The second module is a scanner to identify Webuzo solutions installed on a server. WordPress scanner used by daymon Scan #2: Webuzo To perform the scanning, it sends a GET request to port 80/tcp or 8080/tcp, which are typical HTTP ports.ДЇigure 3. The first module is a scanner to identify WordPress installed on a server. Exposed Tomato & TomatoUSB routers on the Internet Other Scanners Scan #1: WordPress This total is derived by including the number of TomatoUSB devices, which is used as a NAS server by combining the Tomato router and a USB drive.ДЇigure 2. As noted in Figure 2, there are about 4,600 potential victims on the Internet in total. To estimate the infected volume, we searched for fingerprints of Tomato routers in Shodan. Tomato router web authentication bruteforcing We captured the Tomato router web authentication brute forcing traffic, in Figure 1.ДЇigure 1. In Tomato routers, the default credentials are вЂњadmin:adminвЂќ and вЂњroot:adminвЂќ. The new Muhstik variant scans Tomato routers on TCP port 8080 and bypasses the admin web authentication by default credentials bruteforcing. In the following part, we have a detailed analysis of Muhstik botnet. We will keep monitoring its Command and Control (C2) IRC channel. We have not found further malicious activities in Tomato routers after the Muhstik botnet harvests vulnerable routers, but from our understanding of the Muhstik botnet, Muhstik mainly launches cryptocurrency mining and DDoS attacks in IoT bots to earn profit. This new variant expands the botnet by infecting Tomato routers. It also compromises IoT routers, such as the GPON home router and DD-WRT router.

Muhstik uses multiple vulnerability exploits to infect Linux services, such as Weblogic, WordPress and Drupal. The Muhstik botnet has been alive since March 2018, with a wormlike self-propagating capability to infect Linux servers and IoT devices.

By our investigation on Shodan, there are more than 4,600 Tomato routers exposed on the Internet. Thanks to its stable, Linux-based, non-proprietary firmware, with VPN-passthrough capability and advanced quality of service (QoS) control, Tomato firmware is commonly installed by multiple router vendors and also installed manually by end users. Tomato is an open source alternative firmware for routers. 5, 2019, Unit 42 researchers discovered a new variant of the Muhstik botnet that adds a scanner to now attack Tomato routers for the first time by web authentication brute forcing.

Install tcpdump ddwrt