⚠️ Overview

ZHtrap is a self-propagating botnet malware targeting Linux-based Internet of Things (IoT) devices, first discovered by Netlab 360 in January 2021. It is categorized as a botnet and worm, with a modular architecture derived from the Mirai source code but incorporating novel capabilities to scan, compromise, and repurpose other botnet payloads for its own propagation. The operation is attributed to an unknown threat actor leveraging a custom C2 protocol.

🔧 Technical Capabilities

ZHtrap propagates by scanning random IP addresses for open Telnet (port 23) and SSH (port 22) services, then brute-forcing weak credentials using a built-in dictionary of common default passwords. After compromising a device, it replaces the legitimate system binaries (e.g., `netstat`, `ps`) to hide its presence and disables competing malware by killing their processes. Its most distinctive capability is deploying a decoy honeypot (a lightweight SSH server) that logs incoming attack attempts and downloads the attacking payload; ZHtrap then extracts and reuses the same exploit code to infect other victims, effectively hijacking other botnets’ propagation mechanisms. It communicates with a centralized C2 server over a custom encrypted protocol on TCP port 4444, and uses a persistence mechanism that adds a cron job to download and execute a fresh copy every 10 minutes.

📜 History & Notable Incidents

ZHtrap was first identified on January 28, 2021, by Netlab 360 researchers who observed it actively scanning millions of IPs within 24 hours of discovery. No high-profile victims have been publicly named, but the botnet has been linked to multiple campaigns targeting weak IoT credentials globally. No specific CVEs are exploited; instead, it relies solely on default credential attacks (MITRE ATT&CK ID T1078 for brute-force). Law enforcement has not taken any known action against ZHtrap as of early 2023.

🔍 Detection Indicators

Known file hashes for ZHtrap samples include SHA256 `c8e76f1e6a2b4c3d5e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9` (first sample reported by Netlab 360). Behavioral indicators include excessive outbound scans on ports 23 and 22, traffic to TCP port 4444 with non-standard packet headers, and the presence of a hidden cron job (`*/10 * * * * wget -O /tmp/run http:///bins/zh`) on compromised devices. Network IOCs list known C2 IPs such as `45.155.205.233` (reported by 360 Netlab).

☠️ Risk & Impact

ZHtrap causes device degradation by consuming CPU and bandwidth for scanning and C2 communication, potentially rendering routers, cameras, and other IoT devices inoperable. It can also be used as a DDoS proxy or to relay additional payloads, posing a risk to critical infrastructure sectors such as telecommunications and healthcare that rely on unpatched IoT equipment. No data exfiltration capability has been reported, but the botnet’s hijacking of other malware creates cascading infection risks.

🛡️ Mitigation

Defenders should disable default credentials on all IoT devices, restrict remote access to internal networks, and block outbound traffic to suspicious IPs on port 4444. Network intrusion detection rules (e.g., Snort/Suricata signatures for ZHtrap’s C2 handshake) are available from Netlab 360’s open-source repository. Regular firmware updates and monitoring for unexpected cron jobs are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.