FortiGuard Labs observed a spike in the activity of two different botnets - Ficora and Capsaicin - in October and November 2024. These botnets typically spread through vulnerabilities in D-Link devices, allowing attackers to execute malicious commands remotely.
Impact Level
When a device is successfully exploited, attackers leverage weaknesses in the D-Link management interface (HNAP) to execute malicious commands through GetDeviceSettings.
The botnets can steal data and execute shell scripts. The attackers' goal seems to be using the devices for distributed denial-of-service (DDoS) attacks.
The Ficora botnet primarily targets the Japanese and U.S. markets. Meanwhile, Capsaicin appears to mainly target devices in East Asian countries and has increased its activity for two days, starting from October 21.
Figure 1. IPS attack metrics
Ficora Botnet
Ficora is a newer variant of the Mirai botnet, designed to exploit specific vulnerabilities in D-Link devices.
Figure 2. Ficora botnet activity range
After gaining initial access to D-Link devices, Ficora uses a shell script named 'multi' to download and execute its payload through various methods such as wget, curl, ftpget, and tftp, then deletes itself from the victim's system.
Figure 3. Malicious command exploiting a D-Link vulnerability to download “FICORA” malware
This malware uses brute-force methods with predefined username and password lists to infect multiple Linux-based devices, supporting various hardware architectures.
Figure 4. Predefined username list
Figure 5. Predefined password list
Regarding DDoS attack capabilities, it supports UDP flooding, TCP flooding, and DNS amplification, diversifying attack methods to counter defense systems.
Capsaicin Botnet
Capsaicin is a variant of the Kaiten botnet and is believed to be malware developed by the Keksec group, known for the “EnemyBot” malware and many other malware families targeting Linux devices. Fortinet discovered Capsaicin in a series of attacks from October 21 to 22, primarily targeting East Asian countries.
The infection occurs through a download script (“bins.sh”), which downloads binary files prefixed with 'yakuza' for different hardware architectures, including arm, mips, sparc, and x86.
Figure 6. Malicious command exploiting a D-Link vulnerability to download “CAPSAICIN” malware
Additionally, this malware actively searches for other botnets operating on the same server and disables them.
Besides DDoS capabilities similar to Ficora, Capsaicin can also collect server information and transmit it to a command and control (C2) server for monitoring.
Figure 7. List of commands for C2 execution
Figure 8. List of commands for DDoS execution
URLs
FICORA
| hxxp://103[.]149[.]87[.]69/multi |
| hxxp://103[.]149[.]87[.]69/la.bot.arc |
| hxxp://103[.]149[.]87[.]69/la.bot.arm |
| hxxp://103[.]149[.]87[.]69/la.bot.arm5 |
| hxxp://103[.]149[.]87[.]69/la.bot.arm6 |
| hxxp://103[.]149[.]87[.]69/la.bot.arm7 |
| hxxp://103[.]149[.]87[.]69/la.bot.m68k |
| hxxp://103[.]149[.]87[.]69/la.bot.mips |
| hxxp://103[.]149[.]87[.]69/la.bot.mipsel |
| hxxp://103[.]149[.]87[.]69/la.bot.powerpc |
| hxxp://103[.]149[.]87[.]69/la.bot.sh4 |
| hxxp://103[.]149[.]87[.]69/la.bot.sparc |
CAPSAICIN
| hxxp://87[.]11[.]174[.]141/bins.sh |
| hxxp://pirati[.]abuser[.]eu/yakuza.yak.sh |
| hxxp://pirati[.]abuser[.]eu/yakuza.arm5 |
| hxxp://pirati[.]abuser[.]eu/yakuza.arm6 |
| hxxp://pirati[.]abuser[.]eu/yakuza.arm7 |
| hxxp://pirati[.]abuser[.]eu/yakuza.i586 |
| hxxp://pirati[.]abuser[.]eu/yakuza.i686 |
| hxxp://pirati[.]abuser[.]eu/yakuza.m68k |
| hxxp://pirati[.]abuser[.]eu/yakuza.mips |
| hxxp://pirati[.]abuser[.]eu/yakuza.mipsel |
| hxxp://pirati[.]abuser[.]eu/yakuza.ppc |
| hxxp://pirati[.]abuser[.]eu/yakuza.sparc |
| hxxp://pirati[.]abuser[.]eu/yakuza.x86 |
| hxxp://87[.]10[.]220[.]221/bins.sh |
| hxxp://87[.]10[.]220[.]221/yakuza.sh |
| hxxp://87[.]10[.]220[.]221/yakuza.arm4 |
| hxxp://87[.]10[.]220[.]221/yakuza.arm5 |
| hxxp://87[.]10[.]220[.]221/yakuza.arm6 |
| hxxp://87[.]10[.]220[.]221/yakuza.arm7 |
| hxxp://87[.]10[.]220[.]221/yakuza.i586 |
| hxxp://87[.]10[.]220[.]221/yakuza.i686 |
| hxxp://87[.]10[.]220[.]221/yakuza.m68k |
| hxxp://87[.]10[.]220[.]221/yakuza.mips |
| hxxp://87[.]10[.]220[.]221/yakuza.mipsel |
| hxxp://87[.]10[.]220[.]221/yakuza.ppc |
| hxxp://87[.]10[.]220[.]221/yakuza.sparc |
| hxxp://87[.]10[.]220[.]221/yakuza.x86 |
Hosts
| 103[.]149[.]87[.]69 |
| ru[.]coziest[.]lol |
| f[.]codingdrunk[.]cc |
| www[.]codingdrunk[.]in |
| eighteen[.]pirate |
| nineteen[.]libre |
| 75cents[.]libre |
| 2joints[.]libre |
| fortyfivehundred[.]dyn |
| 21savage[.]dyn |
| imaverygoodbadboy[.]libre |
| le[.]codingdrunk[.]in |
| 87[.]11[.]174[.]141 |
| pirati[.]abuser[.]eu |
| 87[.]10[.]220[.]221 |
| 45[.]86[.]86[.]60 |
| 194[.]110[.]247[.]46 |
Files
Downloader
| Value | Type |
| f71dc58cc969e79cb0fdfe5163fbb9ed4fee5e13cc9407a11d231601ee4c6e23 | SHA-256 |
| ea83411bd7b6e5a7364f7b8b9018f0f17f7084aeb58a47736dd80c99cfeac7f1 | SHA-256 |
| 48a04c7c33a787ef72f1a61aec9fad87d6bd9c49542f52af7e029ac83475f45d | SHA-256 |
| 18c92006951f93a77df14eca6430f32389080838d97c9e47364bf82f6c21a907 | SHA-256 |
FICORA
| Value | Type |
| 9b161a32d89f9b19d40cd4c21d436c1daf208b5d159ffe1df7ad5fd1a57610e5 | SHA-256 |
| faeea9d5091384195e87caae9dd88010c9a2b3b2c88ae9cac8d79fd94f250e9f | SHA-256 |
| 10d7aedc963ea77302b967aad100d7dd90d95abcdb099c5a0a2df309c52c32b8 | SHA-256 |
| 7f6912de8bef9ced5b9018401452278570b4264bb1e935292575f2c3a0616ec4 | SHA-256 |
| a06fd0b8936f5b2370db5f7ec933d53bd8a1bf5042cdc5c052390d1ecc7c0e07 | SHA-256 |
| 764a03bf28f9eec50a1bd994308e977a64201fbe5d41337bdcc942c74861bcd3 | SHA-256 |
| df176fb8cfbc7512c77673f862e73833641ebb0d43213492c168f99302dcd5e3 | SHA-256 |
| ac2df391ede03df27bcf238077d2dddcde24cd86f16202c5c51ecd31b7596a68 | SHA-256 |
| ca3f6dce945ccad5a50ea01262b2d42171f893632fc5c5b8ce4499990e978e5b | SHA-256 |
| afee245b6f999f6b9d0dd997436df5f2abfb3c8d2a8811ff57e3c21637207d62 | SHA-256 |
| ec508df7cb142a639b0c33f710d5e49c29a5a578521b6306bee28012aadde4a8 | SHA-256 |
CAPSAICIN
| Value | Type |
| 8349ba17f028b6a17aaa09cd17f1107409611a0734e06e6047ccc33e8ff669b0 | SHA-256 |
| b3ad8409d82500e790e6599337abe4d6edf5bd4c6737f8357d19edd82c88b064 | SHA-256 |
| ec87dc841af77ec2987f3e8ae316143218e9557e281ca13fb954536aa9f9caf1 | SHA-256 |
| 784c9711eadceb7fedf022b7d7f00cff7a75d05c18ff726e257602e3a3ccccc1 | SHA-256 |
| bde6ef047e0880ac7ef02e56eb87d5bc39116e98ef97a5b1960e9a55cea5082b | SHA-256 |
| c7be8d1b8948e1cb095d46376ced64367718ed2d9270c2fc99c7052a9d1ffed7 | SHA-256 |
| 4600703535e35b464f0198a1fa95e3668a0c956ab68ce7b719c28031d69b86ff | SHA-256 |
| 6e3ef9404817e168c974000205b27723bc93abd7fbf0581c16bb5d2e1c5c6e4a | SHA-256 |
| 32e66b87f47245a892b102b7141d3845540b270c278e221f502807758a4e5dee | SHA-256 |
| 540c00e6c0b53332128b605b0d5e0926db0560a541bb13448d094764844763df | SHA-256 |
| b74dbd02b7ebb51700f3c5900283e46570fe497f9b415d25a029623118073519 | SHA-256 |
| 148f6b990fc1f1903287cd5c20276664b332dd3ba8d58f2bf8c26334c93c3af5 | SHA-256 |
| 464e2f1faab2a40db44f118f7c3d1f9b300297fe6ced83fabe87563fc82efe95 | SHA-256 |
| b699cd64b9895cdcc325d7dd96c9eca623d3ec0247d20f39323547132c8fa63b | SHA-256 |
| 1007f5613a91a5d4170f28e24bfa704c8a63d95a2b4d033ff2bff7e2fe3dcffe | SHA-256 |
| 7a815d4ca3771de8a71cde2bdacf951bf48ea5854eb0a2af5db7d13ad51c44ab | SHA-256 |
| d6a2a22000d68d79caeae482d8cf092c2d84d55dccee05e179a961c72f77b1ba | SHA-256 |
| 7ab36a93f009058e60c8a45b900c1c7ae38c96005a43a39e45be9dc7af9d6da8 | SHA-256 |
| 803abfe19cdc6c0c41acfeb210a2361cab96d5926b2c43e5eb3b589a6ed189ad | SHA-256 |
| 7b29053306f194ca75021952f97f894d8eae6d2e1d02939df37b62d3845bfdb7 | SHA-256 |
| 59704cf55b9fa439d6f7a36821a50178e9d73ddc5407ff340460c054d7defc54 | SHA-256 |
| aaa49b7b4f1e71623c42bc77bb7aa40534bcb7312da511b041799bf0e1a63ee7 | SHA-256 |
| 1ca1d5a53c4379c3015c74af2b18c1d9285ac1a48d515f9b7827e4f900a61bde | SHA-256 |
Recommendations
FPT Threat Intelligence recommends organizations and individuals take several measures to prevent this campaign:
Update device firmware: Ensure that routers and IoT devices are always running the latest firmware version to patch known security vulnerabilities.
Replace old devices: If a device has reached the end of its life cycle and no longer receives security updates, replace it with a new model.
Change default passwords: Use strong and unique admin passwords, and disable remote access interfaces if not necessary.
References
