Gitpaste-12 Botnet

The Gitpaste-12 Botnet is a newly identified project that appears to rely heavily on GitHub and Pastebin to achieve its goals. The malware component is compatible with x86 Linux systems, as well as with Linux-based Internet-of-Things (IoT) devices making use of the ARM and MIPS architectures. Cybersecurity experts have identified a dozen exploits that the Gitpaste-12 Botnet leverages to seek out its victims. Some of its common targets are Netlink GPON routers, ASUS routers, Mongo DB installations, AVTECH IP cameras and Huawei routers.

The Gitpaste-12 Botnet's purpose appears to be to plant cryptocurrency miners that utilize the enslaved device's hardware to mine for the Monero cryptocurrency. Apart from this, the infected systems also may be used to scan the Web for other vulnerable addresses that the Gitpaste-12 Botnet could go after.

What is peculiar about the Gitpaste-12 Botnet is that its authors have opted to host the payloads on public GitHub and Pastebin pages. Thankfully, these URLs have been eliminated after the services in question were informed about the abuse happening – this is likely to slow down the Gitpaste-12 Botnet for the moment, but it is a matter of time before the operators of the project adapt to the changes.

Apart from pre-made exploits, the Gitpaste-12 Botnet also relies on brute-force attacks looking to exploit devices with easy-to-guess login credentials. Users can protect their devices from the Gitpaste-12 Botnet by applying the latest firmware updates and security patches, as well as by making sure to use unique and strong login credentials.