New Aquabotv3 botnet malware targets Mitel command injection flaw

A new variant of the Mirai-based botnet malware Aquabot has been observed actively exploiting CVE-2024-41710, a command injection vulnerability in Mitel SIP phones. The activity was discovered by Akamai's Security Intelligence and Response Team (SIRT), who reports that this is the third variant of Aquabot that falls under their radar. The malware family was introduced in 2023, and a second version that added persistence mechanisms was released later. The third variant, 'Aquabotv3,' introduced a system that detects termination signals and sends the info to the command-and-control (C2) server. Akamai comments that Aquabotv3's mechanism to report back kill attempts is unusual for botnets and may have been added to give its operators better monitoring. CVE-2024-41710 is a command injection flaw impacting Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, typically used in corporate offices, enterprises, government agencies, hospitals, educational institutes, hotels, and financial institutions. It is a medium-severity flaw that allows an authenticated attacker with admin privileges to conduct an argument injection attack due to insufficient parameter sanitization during the boot process, resulting in arbitrary command execution. Mitel released fixes and a security advisory about this flaw on July 17, 2024, urging users to upgrade. Two weeks later, security researcher Kyle Burns published a proof-of-concept (PoC) on GitHub. Aquabotv3's use of this PoC to exploit CVE-2024...