FBI Warns of HiatusRAT Targeting Vulnerable IoT Devices

Hackers are deploying brute force attacks and using unpatched vulnerabilities to target Chinese-manufactured web cameras and DVRs, the FBI is warning. Targets include a range of organizations in Taiwan and at least one U.S. government server.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

The bureau in a Monday notice said the campaign uses the HiatusRAT to infect Hikvision and Xiongmai devices. The campaign also sweeps up other internet of things devices including Wi-Fi cameras made by Dahua and Taiwanese company D-Link.

Hikvision is controlled by the Chinese government and is on a number of U.S. federal government blacklists for presenting a national security risk and for its participation in state repression of the Uyghur ethnic group.

The hackers – the FBI doesn’t make an attribution – use telnet to access the devices, using open-source webcam-scanning tool Ingram to scan for devices. They use Medua, an open-source brute force authentication cracking tool, to penetrate Hikvision devices.

Devices made by Hikvision and Xiongmai are perennial favorites for hackers. A 2016 distributed denial-of-service attack by the Mirai botnet that knocked out a swath of the domain name system in the United States was at least partially powered by hacked Xiongmai devices. Researchers in 2021 spotted Mirai variant Moobot targeting remote code execution vulnerability in Hikvision cameras.

Their recurrence as hacker favorites traces back to multiple reasons. The availability of patches is no guarantee that device owners will apply them. Devices sold through unauthorized resellers may not even receive a patch.

Some devices targeted in this HiatusRAT campaign may not even have patches against known vulnerabilities, or may not receive patches since they’re no longer supported by a manufacturer.

The FBI’s analysis from March shows that threat actors actively scanned the internet for web cameras and DVRs, targeting vulnerabilities such as flaws listed in CISA’s Known Exploited Vulnerabilities catalog and exploiting weak vendor-supplied credentials. The hackers focused on flaws such as CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044 and CVE-2021-36260. CVE-2018-9995 affects several rebranded versions of TBK devices, including those from CeNova, DVR Login, HVR Login, MDVR Login, Night OWL, Novo, Pulnix, QSee, Securus and XVR 5 in 1, according to the FBI.