Hoaxcalls Botnet

The Hoaxcalls Botnet is a botnet project that has been followed by malware researchers for the past couple of months closely. The latest attack vector that the authors of this botnet use appear to be related to the ZyXEL Cloud CNM SecuManager – the exploit, first reported last month, would allow a nefarious attacker to open a remote shell on the compromised host. The crooks behind the Hoaxcalls Botnet appear to be one of the first groups to make use of the recent exploit, and this has resulted in a rapid increase in the size of the botnet.

While the Hoaxcalls Botnet has not been used for large-scale attacks yet, malware researchers have determined that this botnet is being built for Distributed-Denial-of-Service (DDoS) attacks – its modules support DNS, HEX, and UDP floods that could be used to disrupt the performance of networks and systems worldwide.

Just like other botnets made in the past few years, the Hoaxcalls Botnet also focuses on infecting Internet-of-Things (IoT) devices. The latest attack against routers manufactured by ZyXEL shows just one of the many exploits that the hackers are relying on to expand their network of infected systems – in the past, they also have gone after routers, DVRs, and other smart devices produced by various vendors.

Unfortunately, the ZyXEL vulnerability that the Hoaxcalls Botnet is abusing currently has not been addressed yet. However, it is certainly a matter of time for the vendor to release a firmware patch that will remove the vulnerability – we advise our readers to update the firmware of their Internet-connected devices regularly, as well as always use strong login credentials.