Condi malware uses exploited TP-Link AX21 to build DDoS botnet

Target Industry

Indiscriminate, opportunistic attacks

Overview

A newly emerged malware, first observed in May 2023, has been seen exploiting the known remote code execution (RCE) vulnerability CVE-2023-1389 discovered in March for the TP-Link Archer AX21 to build a distributed denial-of-service (DDoS) botnet to be sold as a service.

The malware works by initially exploiting the known RCE vulnerability, followed by the deletion of the shutdown and restart scripts within the router to prevent mitigation, as the malware has no other known persistence methods. The malware also employs methods for shutting down older versions of Condi and other botnets that may already be running.

Impact

Successful execution of the malware could lead to a user’s network being used by threat actors that purchase use of the service for malicious DDoS attacks as part of a campaign on another user or organisation. The DDoS attacks are also implemented for the purposes of causing disruption to target networks.

Vulnerability Detection

A comprehensive endpoint detection and response (EDR) solution, such as Microsoft Defender, can provide additional protection against threats such as ‘Condi’. EDRs can alert system users of potential breaches and prevent further progress, prior to the malware being able to implement significant damage.

Affected Products

TP-Link Archer AX21 router.

Containment, Mitigations & Remediations

As mentioned previously, it is recommended that an EDR solution is implemented which will allow for the prevention or mitigation of potential attacks from a wide range of threats in real time.

All devices should implement the most recent vendor updates available as these will contain updates to their security features to help prevent exploitation from known threats.

Indicators of Compromise

Condi associated file hashes (SHA256):

• 091d1aca4fcd399102610265a57f5a6016f06b1947f86382a2bf2a668912554f
• 291e6383284d38f958fb90d56780536b03bcc321f1177713d3834495f64a3144
• 449ad6e25b703b85fb0849a234cbb62770653e6518cf1584a94a52cca31b1190
• 4e3fa5fa2dcc6328c71fed84c9d18dfdbd34f8688c6bee1526fd22ee1d749e5a
• 509f5bb6bcc0f2da762847364f7c433d1179fb2b2f4828eefb30828c485a3084
• 593e75b5809591469dbf57a7f76f93cb256471d89267c3800f855cabefe49315
• 5e841db73f5faefe97e38c131433689cb2df6f024466081f26c07c4901fdf612
• cbff9c7b5eea051188cfd0c47bd7f5fe51983fba0b237f400522f22ab91d2772
• ccda8a68a412eb1bc468e82dda12eb9a7c9d186fabf0bbdc3f24cd0fb20458cc
• e7a4aae413d4742d9c0e25066997153b844789a1409fd0aecce8cc6868729a15
• f7fb5f3dc06aebcb56f7a9550b005c2c4fc6b2e2a50430d64389914f882d67cf

Threat Landscape

This exploitation is one of many publicly available DDoS services that allow even non-technical users to employ powerful DDoS attacks on a particular IP address range to disrupt or completely shut down traffic on a network through overloading of requests. These attacks have been prevalent for an extensive period due to their simplicity of execution and effectiveness.

Threat Group

The threat actor group known as Condi has been providing the DDoS botnet as a service and selling the source code of the malware since May 2022.

Mitre Methodologies

Resource Development

T1583.005 – Botnet

T1588.006 – Vulnerabilities

Impact

T1499 – Endpoint Denial of Service

Further Information

Condi DDoS Botnet Spreads via TP-Link’s CVE-2023-1389