MikroTik botnet uses misconfigured SPF DNS records to spread malware

A newly discovered botnet of 13,000 MikroTik devices uses a misconfiguration in domain name server records to bypass email protections and deliver malware by spoofing roughly 20,000 web domains. The threat actor takes advantage of an improperly configured DNS record for the sender policy framework (SPF) used for listing all the servers authorized to send emails on behalf of a domain. According to DNS security company Infoblox, the malspam campaign was active in late November 2024. Some of the emails impersonated DHL Express shipping company and delivered fake freight invoices with a ZIP archive containing a malicious payload. Inside the ZIP attachment there was a JavaScript file that assembles and runs a PowerShell script. The script establishes a connection to the threat actor’s command and control (C2) server at a domain previously tied to Russian hackers. “The headers of the many spam emails revealed a vast array of domains and SMTP server IP addresses, and we realized we had uncovered a sprawling network of approximately 13,000 hijacked MikroTik devices, all part of a sizeable botnet,” explains Infoblox. Infoblox explains that SPF DNS records for about 20,000 domains were configured with the overly permissive "+all" option, which allows any server to send emails on behalf of those domains. "This essentially defeats the purpose of having an SPF record, because it opens the door for spoofing and unauthorized email sending" - Infoblox A safer choice is using the "-all" opti...