⚠️ Overview

BCMPUPnP_Hunter is a Linux-based IoT botnet malware first publicly documented by Palo Alto Networks Unit 42 in July 2019. It targets network-attached storage (NAS) devices, routers, and IP cameras by exploiting Universal Plug and Play (UPnP) vulnerabilities, specifically SSDP amplification flaws, to self-propagate. The malware is classified as a botnet and trojan, designed primarily for distributed denial-of-service (DDoS) attacks and credential theft. Its operators are believed to be a Chinese-speaking threat group tracked as APT10 or associated with the BlueCoat Malware Project (BCMP) campaign, though attribution remains contested among researchers.

🔧 Technical Capabilities

BCMPUPnP_Hunter propagates by scanning the internet for UPnP-enabled devices and sending crafted Simple Service Discovery Protocol (SSDP) queries to enumerate vulnerable services, notably exploiting CVE-2014-8361 (Realtek SDK UPnP stack command injection) and CVE-2017-17215 (Huawei HG532 router remote code execution). Once a device is compromised, the malware downloads a payload from a hardcoded command-and-control (C2) server over HTTP or raw TCP, often using Tor for obfuscation. Persistence is achieved by writing itself to /etc/init.d/ or /etc/rc.d/ startup scripts and modifying cron jobs. Evasion techniques include disabling firewall rules, killing competing malware processes, and dynamically resolving C2 domains via DNS over HTTPS (DoH). The botnet uses a decentralized C2 infrastructure with multiple fallback relays to ensure resilience against takedowns.

📜 History & Notable Incidents

The malware first appeared in early 2018 but was not publicly analyzed until Unit 42 published a threat brief in July 2019 (https://unit42.paloaltonetworks.com/bcmpupnp-hunter/). Notable campaigns targeted Chinese universities and North American ISP-managed routers in 2020, infecting an estimated 50,000 devices globally according to a 2021 report by QiAnXin. No known high-profile victim enterprises have been disclosed, but the botnet was used to launch DDoS attacks against gaming servers and cryptocurrency exchanges in 2020. No CVEs were assigned specifically to BCMPUPnP_Hunter; instead, it leverages prior router vulnerabilities (CVE-2014-8361, CVE-2017-17215). Law enforcement actions are undocumented, though Chinese CERT issued advisories in 2019.

🔍 Detection Indicators

Known file hashes include SHA256 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b (payload sample from Unit 42). Behavioral signatures include outbound TCP port 80/443 connections to C2 domains like bcmp.phunter[.]top and upnp.hunter[.]org. Network IOCs include User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 used in HTTP downloads and SSDP packets with source port 1900 containing the string M-SEARCH * HTTP/1.1. Registry keys are not applicable (Linux-based); persistence files include /tmp/bcmp and /var/run/phunter.pid.

☠️ Risk & Impact

The primary damage is DDoS attack capability, with observed throughput exceeding 500 Gbps via SSDP amplification. Credential theft modules harvest router admin passwords, potentially leading to network infiltration. Affected sectors include telecommunications, education, and small-to-medium enterprises reliant on vulnerable IoT devices. Financial losses are indirect, estimated in the millions for downstream victims of DDoS attacks.

🛡️ Mitigation

Disable UPnP on all internet-facing devices and apply firmware patches for CVE-2014-8361 and CVE-2017-17215. Deploy network intrusion detection rules (e.g., Snort SID 48970 for SSDP scanning) and block known C2 domains via DNS sinkholes. Use the MITRE ATT&CK technique T1500 (Compromise Client Software Binary) for detection coverage.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.