Emerging IoT Wiper Malware: Kaden and New LOLFME Botnet Variants

What Is Wiper Malware?

Wipers are malware that delete data on a device or make it inaccessible. They can be used for sabotage, to destroy evidence of an attack or simply to make a device unusable. IoT wipers often rewrite important parts of the firmware of an IoT device, rendering that device useless, so they are also known as “brickers”.

Recent notorious examples of IoT wipers are AcidRain which was used by a Russian APT to brick satellite modems in Europe at the outset of the Russian invasion of Ukraine in 2022.  AcidPour, a newer variant of AcidRain, was used in attacks against Ukrainian telecommunication networks in 2024. However, IoT wipers have existed since at least 2017. Brickerbot is the first known example.

Here, we show how we used past examples of IoT wipers to find emerging wiper behavior on two botnets that we believe are currently under development:

• A new botnet that we dub ‘Kaden botnet’ based on strings found in the samples analyzed. This malware mixes and matches parts of previous botnet clients, adds a specific signature and includes a wiping function that is not yet in use.
• A new variant of the LOLFME botnet originally attributed to the KekSec team. This variant retains functionality similar to previous wipers and introduces a new behavior: Wiping a device if it fails to communicate with a C2 IP address.

We analyze these botnets to extract indicators of compromise and gather intelligence about their authors.

This research reveals wipers are a growing threat that organizations should not overlook. Significant attention is focused on malware like DDoS botnets and cryptominers on IoT devices. Defending against IoT wipers is particularly crucial for those in critical infrastructure sectors that are often targeted by opportunistic attackers.

Finding New IoT Wiper Malware Botnets

We began by compiling a collection of 25 known IoT wiper samples:

• 1 sample each of AcidRain, AcidPour, Brickerbot and HEH
• 5 samples of VPNFilter
• 9 samples of Silex
• 7 samples of HandyMannyPot

To identify new IoT malware with wiping capabilities, we developed a YARA rule that captures the known wiping behavior from the samples above. These behaviors include deleting data, writing junk data on specific device paths, and rebooting devices. The figure below summarizes the conditions included in that rule.

We deployed this rule on VirusTotal’s RetroHunt to identify files submitted between February and May 2024 that exhibited the expected wiping behavior. The hunt yielded eight matches:

• Three samples appeared to be a variant of KekSec’s LOLFME botnet, based on a quick string analysis.
• Five samples contained an intriguing string “KADENBOTNET” which did not correspond to any previously known wiper or botnet family.

Subsequently, we searched for the “KADENBOTNET” string in VirusTotal files up to May 2024 and conducted a LiveHunt with our YARA rule from May to the end of June 2024. In total, we discovered the following 22 samples of the Kaden botnet:

Of the 22 samples, 18 had a single submission to VirusTotal, with 16 of those submissions originating from China. One sample (c557a99d78a0adbcf5e040f71458d682d3093fd8ac3e2624b7a780a9a9e5d1bd) had two submissions: one shown in the table, and another on April 27, 2024, also from China. Only two samples had multiple submissions: 9 for 6103262a245fb296edf2f5c0ffc99e5a74bc4b267d304a92c934e37045811d93 and 12 for 49addddb7fbfa9717a0f4cabe88dc0570778eee33a086b2e2c8bfdf9d91eec68. The earliest submission was on January 10, 2019, from France.

Of the 22 samples, 18 had a single submission to VirusTotal, with 16 of those submissions originating from China. One sample (c557a99d78a0adbcf5e040f71458d682d3093fd8ac3e2624b7a780a9a9e5d1bd) had two submissions: one shown in the table, and another on April 27, 2024, also from China. Only two samples had multiple submissions: 9 for 6103262a245fb296edf2f5c0ffc99e5a74bc4b267d304a92c934e37045811d93 and 12 for 49addddb7fbfa9717a0f4cabe88dc0570778eee33a086b2e2c8bfdf9d91eec68. The earliest submission was on January 10, 2019, from France.

Since most of the samples were newly submitted between February and May 2024, this indicates that the botnet’s development is ongoing. Another sign of its evolving capabilities is that only the last five samples include the wiping function, which matched our original YARA rule.

Each sample had a hardcoded C2 IP address, all of which belong to virtual private server (VPS) providers that have hosted different botnet C2s since 2019. Notably, one IP address, 185.244.25[.]166, had a distinctive domain name. In 2019, when the first samples were submitted, it resolved to alex-botnet[.]xyz, including subdomains cnc.alex-botnet[.]xyz and www.alex-botnet[.]xyz.

Most samples also contained hardcoded downloader IP addresses, which pointed to additional malware that could be downloaded, such as the file Okami.sh which leads to an Okami botnet sample. These IP addresses have hosted numerous malicious files for several years.

All the samples are classified as Gafgyt or Mirai by most detection engines. This is common with new botnets that are variants of known malware. As discussed in our previous research, classifying IoT botnet variants is challenging due to minor differences in behavior amid many similarities.

Wiper Malware Analysis: Kaden Botnet

To understand the behavior of this newly developed botnet, we analyzed the five most recent samples, that include the wiping behavior. The first notable aspect is that the botnet appears to mix and match various functions and elements from several other botnets.

The overall structure of the bot is derived from a version of the “rebirth” botnet client from 2017. This structure has been used by Gafgyt variants in the past. Many of the C2 commands found in Kaden botnet, described below, are also similar to those seen in Gafgyt.

The client first initializes a TCP socket to a hardcoded C2 address (such as those listed in the table above). It then sends the host’s build architecture (e.g., “x86_64”) and byte ordering (e.g., “LITTLE_ENDIAN”) over this connection and waits for further instructions from C2. The C2 can send one of the following instructions, which the bot will execute:

1. ICMP – Does nothing.
2. HTTP – Initiates an HTTP flood attack. The C2 can specify the request method, target host, port, path, attack duration and number of attacks.
3. HTTPHEX / HTTPTXT – Similar to HTTP, but uses a string in the form of “KADENBOTNET<hardcoded random string>KADENBOTNET” as the requested path.
4. UDP / TCP – Initiates a flood attack where the C2 can choose to spoof the source IP.
5. STD / STDHEX – Initiates another simple UDP flood attack.
6. STOP – Halts ongoing attacks by killing forked processes.
7. CLEAN – Calls the CleanDevice() function, shown below, to remove logs and temporary files, and flush and stop iptables and firewalld. This function seems to be a slightly modified version of the RemoveTMP() function from yet another Mirai botnet variant.

The botnet client also detects and logs attempts to use of the following commands, suggesting that similar bots might respond to these commands or that they may be added in the future: BOTKILL, GTFO, LOLGTFO, and SH.

The wiping functionality is found in a function called KillDevice() which appears to be directly sourced from Silex since it uses the same “ii11II” variable name. However, this function is not currently called by any C2 command indicating that the botnet is still under development.

In conclusion, it appears that the author of this botnet acquired a version of the ‘rebirth’ bot source code, copy-pasted and renamed some commands and added their ‘KADENBOTNET’ signature to ensure this string appears in the logs of their targets. Additionally, they were in the process of incorporating the wiping capability used by Silex.

Kaden Botnet: Who Is Behind It?

In addition to the “KADENBOTNET” string that led us to identify this new botnet, we discovered two other related strings in the samples: “Kaden1337” and “KaDeNTheBoTNETHeGOD”. Using these strings as seeds for an investigation, we sought to determine the identity or significance of  ‘Kaden’.

On YouTube, we found a profile named ‘@Kaden1227’ that uploaded four videos between 2018 and 2020, all related to botnets or similar activities, as shown below.

The most recent two videos advertised ‘spots’ (compromised devices) on the Okami botnet and a stresser service called ezslap[.]com facilitates launching DDoS attacks. On the video about the stresser service, the username ‘KadenTehGod’ is also visible.

The most interesting video is the oldest one dated March 2018. In this video, someone demonstrates how to setup a botnet server. The person, who appears to be using their own voice, sounds like a young male with an American accent. Several indicators suggest that this individual is based in the United States:

• The date on the system clock in the video is “3/18/2018,” using the American date format.
• The “fastest mirrors” for the downloaded packages resolve to domains of American universities (e.g., mirror.umd.edu and mirror.es.its.nyu.edu). Fastest mirrors are typically influenced by geographical location.

In the same video, ‘Kaden’ shows how he stores many of the files he sells on a website hosted at account-gen[.]xyz, which has a similar format to the alex-botnet[.]xyz domain used by one of the IPs in the recent Kaden botnet: 185.244.25[.]166. Additionally, the video shows a Discord channel called ‘Kadens Eleet’ where the username  ‘Kaden1337’ is also displayed.

Analysis: LOLFME Wiper Variant

Similar to our approach with the Kaden botnet, we ran a LiveHunt using our YARA rule from May through the end of June 2024 after conducting the RetroHunt for samples submitted between February and May. This search yielded the following four recent samples containing distinctive LOLFME strings:

This botnet is more complex than Kaden and does not appear to incorporate functionality from several sources, instead it represents an evolution in KekSec botnet variants.

KekSec, a group created in 2016, is known for its experienced botnet developers. They have deployed well-known botnets such as Mirai and Gafgyt, and developed their own, including Necro, LOLFME, and EnemyBot, the latter of which has become an open-source project on Github. KekSec is recognized for continually enhancing their botnets with new functionality.

While we cannot definitively say whether these samples were developed by KekSec members or adapted from their source code, their open-source code does not contain the “lol f me” string found in these samples. This string is absent from GitHub repositories. LOLFME was originally developed between May and August 2019 making it a short-lived botnet.

The first sample we analyzed, identified as ff33ce4ea04cf26ad62ca72e6b3072485ed6a5e16ee981cb471bd649b12f9494, begins execution by obfuscating the process name of its executable to a random sequence derived from the victim machine’s time. Then it clears environment variables and disables any response to its terminal session or the death of child processes, thereby strengthening its execution.

The malware attempts to evade dynamic analysis by creating diversionary child processes and prevents the system kernel from resetting by either petting the watchdog timer (using ioctl 0x80045705) or completely disabling it (using ioctl 0x80045704). This technique has also been exploited by Mirai and Gafgyt botnets in the past. Ultimately, the malware maintains the highest possible privileges (root) and detaches from the terminal to run in the background without interruption.

The botnet process connects to a hardcoded C2 IP address obfuscated with a simple XOR algorithm. Upon establishing the connection, the malware sends a status announcement in the form of “id:process_name” (with process_name being the previously generated random process name variable) along with the sequence of bytes 0x30, 0x78, 0x31, 0x5c, 0x30, 0x78, 0x31, 0x5c, 0x30, 0x78, 0x35, 0x5c, 0x30, 0x78, 0x37, 0x5c, 0x30, 0x78, 0x39, 0x5c, 0x30, 0x78, 0x30 on TCP port 4077.

The novel behavior we observed (matching our YARA rule) is that if the connection to the C2 fails, the malware terminates all attack modules and wipes the directories “/” and “/proc/net/tcp”.

Once the C2 connection is established, the malware executes three modules:

• Killer00: Terminates any process that doesn’t have a path like [“/usr/”, “/systemd/”, “bin/”, “mi”, “aa”, “aaa”, “aaaa”, “daaaa”, “mmi”, “html”, “clouds”, “cloudrop”]
• telnet_init: Scans the local network using Telnet for devices with weak credentials, such as [(‘support’, ‘support’), (‘user’, ‘user’), (‘admin’, ‘ho4uku6at’), (‘support’, ‘1234’), (‘admin’, ”), (‘root’, ”), (‘admin’, ‘1234’), (‘password’, ‘password’), (‘admin’, ‘admin’), (‘admin’, ‘changeme’), (‘root’, ‘changeme’), (‘root’, ‘root’), (‘root’, ‘20080826’), (‘root’, ‘admin’), (‘root’, ‘12345’), (‘root’, ‘vizxv’), (‘root’, ‘xc3511’), (‘root’, ‘123456’), (‘root’, ‘default’), (‘root’, ‘5up’), (‘root’, ‘zlxx.’), (‘default’, ”), (‘default’, ‘default’), (‘guest’, ”), (‘guest’, ‘guest’), (‘12345’, ‘guest’), (‘123456’, ‘default’), (‘admin’, ‘pass’), (‘root’, ‘pass’), (‘telnet’, ‘telnet’)]
• connection_handler: Parses commands from the C2 and executes them. Several commands are similar to the DDoS attacks seen in Kaden botnet, some are specific DDoS attacks targeting gaming servers, and one particularly interesting command is “bricklol”. This command wipes the authentication log at /var/log/auth.log and the shell histories at bash_history and zsh_history by linking them to /dev/null It then composes multiple commands to wipe mtd (flash memory) and sda (hard drives) devices, disable networking routes, flush iptables rules, add an iptables rule to DROP all INPUT and FORWARD requests, and finally reboot the device.

The second sample (26a494382bbfa16e8674beee16c89e5704b8abd1e1283b0fa28ec2d9d7bfebd9) introduced a few new commands that monitor the local network and report back to the C2. It also fixed the broken implementations of a some previous DDoS commands and added a check to detect if the parent process of the malware is strace, gdb, lldb or ltrace in order to evade dynamic analysis.

The subsequent samples incorporated similar improvements, further indicating that this botnet is under active development.

Conclusion

We do not have evidence that these two new wiper botnets are being deployed in the wild yet. The fact that most samples have single submissions on VirusTotal and other evidence we discussed above suggests ongoing development and testing against detection engines.

These botnets, particularly their wiper behavior, could be deployed against targets after this testing phase is complete. Alternatively they could simply be the work of teenagers experimenting with botnets without intending to deploy them. However, the combination of botnets, wipers and inexperienced developers is dangerous. This was demonstrated by Silex 2019 when it wiped thousands of IoT devices and left the following message.

Share This: Share on LinkedinShare on TwitterShare on Facebook