Devils in the Clouds: An Evolutionary Study of Telnet Bot Loaders

TL;DR

This paper presents a semantic-aware, behavior-based method to analyze and categorize Telnet bot loaders, revealing their evolution and genealogy, which enhances understanding of Mirai's development and aids cybersecurity efforts.

Contribution

It introduces a novel approach to study loader evolution independently from payloads, using behavior-based clustering to define loader families and their genealogy.

Findings

Mirai source code is evolving with new capabilities.

Eight loader families identified through clustering.

Loader analysis aids in improving detection and prevention.

Abstract

One of the innovations brought by Mirai and its derived malware is the adoption of self-contained loaders for infecting IoT devices and recruiting them in botnets. Functionally decoupled from other botnet components and not embedded in the payload, loaders cannot be analysed using conventional approaches that rely on honeypots for capturing samples. Different approaches are necessary for studying the loaders evolution and defining a genealogy. To address the insufficient knowledge about loaders' lineage in existing studies, in this paper, we propose a semantic-aware method to measure, categorize, and compare different loader servers, with the goal of highlighting their evolution, independent from the payload evolution. Leveraging behavior-based metrics, we cluster the discovered loaders and define eight families to determine the genealogy and draw a homology map. Our study shows that the source code of Mirai is evolving and spawning new botnets with new capabilities, both on the client side and the server side. In turn, shedding light on the infection loaders can help the cybersecurity community to improve detection and prevention tools.