Trusted Design

ELF binaries on consumer-grade gateway routers - pnscan 2

概要

An AirRouter received an SSH connection from 220.246.111.206 which placed 4 binaries in /tmp/.xs/ There are 4 binaries, one each for MIPS, MIPSEL, ARM, and i686 copied to the device, suggesting automated backdooring bots. The attack would periodically re-infect the device. Work done on these ELFs by MMD and Unixfreaxjp : http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3975&p=26827#p26827 These may be related to Dyreza C2 system.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Linux/PnScan ; ELF worm (score: 0.70)
• MMD-0047-2015 - SSHV: SSH bruter ELF botnet malware (score: 0.64)
• ELF binaries on consumer-grade gateway routers - Gafgyt (score: 0.62)
• Linux DDoS Malware delivered via SSH (score: 0.61)
• New Trojan for Linux infects routers (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る