⚠️ Overview

Backdoor is a malicious Internet of Things (IoT) botnet variant derived from the Mirai source code, first identified by researchers at Palo Alto Networks Unit 42 in a 2017 report. It is maintained by an unknown threat actor and primarily targets Linux-based IoT devices such as routers, IP cameras, and DVRs with weak default credentials.

🔧 Technical Capabilities

Backdoor performs automated scanning of Telnet (port 23) and SSH (port 22) services to identify devices using default or easily guessable credentials. After successful brute‑force authentication, it downloads and executes a malicious binary that establishes persistence, disables competing malware, and adds the device to a botnet for distributed denial‑of‑service (DDoS) attacks. The botnet supports multiple DDoS vectors, including SYN floods, UDP floods, HTTP GET/POST floods, and DNS amplification attacks. It also incorporates self‑propagation logic by scanning random IP addresses on the internet and attempting to infect additional vulnerable devices. The malware communicates with a central command‑and‑control (C2) server over a custom TCP protocol, using encrypted payloads to evade detection. Backdoor variants have been observed with obfuscated binaries and polymorphic code to bypass signature‑based antivirus tools.

📜 History & Notable Incidents

The Backdoor botnet first surfaced in late 2017, with researchers documenting its activity through honeypot deployments. In 2018, it was linked to a series of large‑scale DDoS attacks targeting online gaming platforms and a major European ISP, causing service disruptions for hours. The botnet’s source code was later leaked on a hacker forum, leading to the emergence of multiple derivative botnets. No specific CVEs are associated with Backdoor itself; it exploits known weak credentials rather than zero‑day vulnerabilities.

🔍 Detection Indicators

Infected devices exhibit increased outbound traffic on ports 23 and 22 to random IP ranges, along with sustained high CPU usage and unusual process names such as “.b” or “bashd”. Known User‑Agent strings used in HTTP‑based C2 communication include “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36” and “curl/7.47.0”. The malware also modifies /etc/init.d/ scripts to ensure persistence across reboots.

☠️ Risk & Impact

Successful infection turns the device into a DDoS zombie, capable of generating over 1 Gbps of attack traffic. The botnet can also be used as a proxy for data exfiltration, credential theft, and as a launching pad for further internal network attacks. Compromised devices may become unreachable for legitimate management.

🛡️ Mitigation

Backdoor is blocked immediately on detection because it poses an immediate threat of resource exhaustion, network congestion, and potential lateral movement. Mitigation requires disabling Telnet, changing default credentials, and applying firmware updates from device vendors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.