The Resurgence of IoT Malware: Inside the Mirai-Based "Gayfemboy" Botnet Campaign

Description

FortiGuard Labs has been tracking a stealthy malware strain called "Gayfemboy" that exploits vulnerabilities in DrayTek, TP-Link, Raisecom, and Cisco products. The malware, based on Mirai, has evolved in form and behavior, targeting multiple countries and sectors. Gayfemboy employs obfuscation techniques, anti-analysis measures, and multiple functions including Monitor, Watchdog, Attacker, and Killer. It uses public DNS servers to bypass filtering and establishes communication with C2 servers through predefined domains. The malware can execute various commands, launch DDoS attacks, and maintain persistence. This evolution highlights the increasing sophistication of modern malware and the need for proactive defense strategies.