Emerging Cyber Threats: Mirai Botnet, Apple Silicon Vulnerabilities, and ChatGPT Exploit

A Mirai botnet variant called Aquabot has been observed exploiting a medium-severity security flaw (CVE-2024-41710) in Mitel phones to recruit them into a network capable of launching distributed denial-of-service (DDoS) attacks. The vulnerability allows an authenticated attacker to execute arbitrary commands due to insufficient parameter sanitization, and Aquabot using a proof-of-concept (PoC) exploit to target the vulnerability, requires authentication and brute-forcing to gain initial access, after which the malware downloads and installs an Aquabot payload, sets up persistence, and connects to its command-and-control (C2) server to receive instructions. The goal of Aquabot is to enlist devices in a DDoS swarm, which is advertised on Telegram as a testing tool for DDoS mitigation measures, but is suspected to be offered as a DDoS service, and has been spotted spreading through other vulnerabilities, including those in Hadoop YARN, Linksys, Teltonika, Dasan GPON, and LB-LINK routers, highlighting the ongoing issue of Mirai-based botnets targeting internet-connected devices with poor security features. Additionally, separate security concerns have been discovered, including two (2) new side-channel attacks, SLAP and FLOP, that target Apple silicon and could be used to leak sensitive information from web browsers like Safari and Google Chrome, by exploiting vulnerabilities in Apple’s speculative execution mechanism and CPU performance-improving features. A vulnerability in ChatGPT, dubbed “Time Bandit,” has also been identified, allowing users to bypass the AI model’s safety guidelines and obtain detailed instructions on sensitive topics, including the creation of weapons, nuclear information, and malware, by exploiting weaknesses in ChatGPT’s timeline confusion and procedural ambiguity, further emphasizing the need for continued research and vigilance in the face of evolving cyber threats. CTIX analysts will continue to report on the latest malware strains and attack methodologies.