A sophisticated new malware called KadNap has been discovered targeting Asus routers and conscripting them into a botnet for proxying malicious traffic. The malware employs a custom version of the Kademlia Distributed Hash Table protocol to conceal its command-and-control infrastructure within a peer-to-peer system, evading traditional network monitoring. The botnet, which has grown to over 14,000 infected devices, is marketed by a proxy service called Doppelganger, tailored for criminal activity. More than 60% of KadNap's victims are based in the United States. The malware demonstrates versatility by targeting various edge networking devices and employing different C2 servers for different victim types.
IPCola is a proxy service leveraging millions of IP addresses sourced from IoT, desktop, and mobile devices. It is linked to Gaganode, a decentralized bandwidth monetization platform with botnet-like features and an SDK capable of remote code execution. The service is distributed via various applications, including Chinese TV boxes and free software, creating a complex proxy network involving InstaIP and NuoChen Technology. This infrastructure enables attackers to harness a large pool of unique IPs for proxying traffic, potentially masking malicious activities. Although no known exploits are currently active, the remote code execution capability poses significant risks. The threat is medium severity due to the potential for widespread abuse and the difficulty in detecting such proxy networks. European organizations could be impacted by abuse of these IPs for anonymizing attacks or evading detection. Mitigation requires enhanced network monitoring, blocking suspicious IP ranges, and scrutinizing applications that may embed the Gaganode SDK. Countries with high IoT adoption and significant use of Chinese-origin devices, such as Germany, France, and the UK, are more likely to be affected.
