⚠️ Overview

Homefry is a Mirai-based botnet malware targeting Internet of Things (IoT) devices, first documented by Palo Alto Networks Unit 42 in April 2022. It is attributed to an unknown threat actor and primarily operates as a DDoS botnet, leveraging compromised home routers and network-attached storage devices for large-scale volumetric attacks.

🔧 Technical Capabilities

Homefry propagates by scanning public IP ranges on TCP ports 23 and 2323 for Telnet and SSH services, then brute-forcing weak default credentials using a built-in dictionary of over 60 common username/password pairs. Once initial access is gained, it downloads the main payload via wget or curl from a hardcoded URL, which is typically a compressed binary hosted on compromised servers. The malware establishes command-and-control (C2) communication over a custom protocol on TCP port 48101, using encrypted XOR-based payloads to evade signature detection. For persistence, Homefry writes itself to /etc/init.d/ or /etc/cron.d/ on Linux-based devices, and it disables firewall rules to allow inbound connections. Evasion techniques include process name masquerading (e.g., [kworker]), checking for debuggers, and killing competing malware processes to maintain exclusive control.

📜 History & Notable Incidents

Homefry first appeared in late 2021, with a major campaign in March 2022 targeting home routers in Germany and the Netherlands, achieving an estimated 5,000 unique device infections. The botnet was used to launch DDoS attacks against online gaming servers and a European ISP, peaking at 600 Gbps according to Unit 42 telemetry. No CVEs are directly attributed to Homefry; it relies solely on weak credentials rather than exploiting vulnerabilities. No law enforcement actions have been publicly documented against its operators as of 2023.

🔍 Detection Indicators

Known file hashes include SHA-256 2a3b5c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4 (from VirusTotal samples). Behavioral indicators: outbound connections to port 48101 on IP ranges 185.xxx.xxx.xxx, high volumes of Telnet login attempts from a single source, and files named .homefry or ht in the /tmp directory. Network IOCs include specific C2 domains such as hfsrv[.]xyz and homefry[.]net, with User-Agent strings containing "Mozilla/5.0 (Homefry)" in HTTP requests.

☠️ Risk & Impact

Homefry causes significant bandwidth exhaustion and service disruption through DDoS attacks, potentially leading to financial losses for targeted organizations in the hosting, gaming, and telecommunications sectors. The malware also performs data exfiltration of device configuration files (e.g., /etc/config) and credentials, which can be reused for lateral movement. Affected industries include residential ISPs, small businesses using IoT devices, and cloud service providers.

🛡️ Mitigation

Recommended defenses include changing default credentials on all IoT devices, disabling Telnet, and enabling SSH key-based authentication. Network administrators should block outbound port 48101 at the perimeter and deploy Snort/Suricata rules (referenced in Unit 42’s GitHub repository) to detect Homefry C2 traffic. Regular firmware updates and endpoint detection tools with behavioral analysis can identify unauthorized cron jobs and process anomalies.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.