{
  "name": "Botnets Never Die: An Analysis of the Large Scale Botnet AIRASHI",
  "slug": "botnets-never-die-an-analysis-of-the-large-scale-botnet-airashi",
  "description": "The AIRASHI botnet, an evolved version of AISURU, has been observed conducting large-scale DDoS attacks and exploiting vulnerabilities in various devices. It utilizes a 0DAY vulnerability in cnPilot routers for propagation and employs sophisticated encryption techniques for communication. The botnet demonstrates stable T-level DDoS capabilities, with attack capacity ranging from 1-3 Tbps. AIRASHI targets multiple industries globally, with a focus on China, the United States, Poland, and Russia. The botnet's samples are frequently updated, incorporating features such as proxy services and reverse shell functionality. Its communication protocol includes HMAC-SHA256 verification and ChaCha20 encryption. The operators mock security researchers through their choice of domain names.",
  "published": "2025-01-16T10:06:52+00:00",
  "created_at": "2025-01-16T10:06:52+00:00",
  "modified_at": "2025-01-16T11:00:54+00:00",
  "created_at_opencti": "2025-01-16T10:06:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-01-16",
    "CVE-2022-3573",
    "airashi",
    "aisuru",
    "botnet",
    "chacha20",
    "cnpilot",
    "ddos",
    "encryption",
    "hellokitty",
    "hmac-sha256",
    "proxy",
    "rc4",
    "vulnerability"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "190.123.46.21"
      },
      {
        "id": "",
        "name": "162.220.163.14"
      },
      {
        "id": "",
        "name": "190.123.46.55"
      },
      {
        "id": "",
        "name": "95.214.52.167"
      },
      {
        "id": "",
        "name": "honeybooterz.cve-2021-36260.ru"
      },
      {
        "id": "",
        "name": "foxthreatnointel.africa"
      },
      {
        "id": "",
        "name": "8e12df8893a638354d851bcb46b5b7dc451c6f52066305ac641de60c80d11850"
      },
      {
        "id": "",
        "name": "72821513d59d491f13d5fdcb36fc311d202da0b876079c38e21ba77422e7781c"
      },
      {
        "id": "",
        "name": "1576598bb6fa7163dd1d578639e6b1d0ef64ef82fbf5d2d34cfd22525187570c"
      }
    ],
    "malware": [
      {
        "id": "dad2d3ad-ef0f-48e6-9dda-f5040a0afe71",
        "name": "AIRASHI",
        "slug": "airashi"
      },
      {
        "id": "73d15bb9-c597-4117-b255-490d15c9cae0",
        "name": "AISURU",
        "slug": "aisuru"
      },
      {
        "id": "68dff35e-2206-4221-8a6b-1385354d2d9b",
        "name": "HELLOKITTY - S0617",
        "slug": "hellokitty-s0617"
      }
    ],
    "intrusion_sets": [
      {
        "id": "fb05172d-5e8d-455f-9148-9e515a53e4b2",
        "name": "AIRASHI",
        "slug": "airashi"
      }
    ],
    "attack_patterns": [
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "e73b317e-ea92-49b4-a45d-051f7279aced",
        "name": "T1213"
      },
      {
        "id": "88fa397b-4cc9-42c0-b52d-4108f9630529",
        "name": "T1095"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "6d618903-d9f6-4747-aec2-7630f43c1908",
        "name": "T1496"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2022-3573"
      },
      {
        "id": "",
        "name": "CVE-2021-36260"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Poland"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Russian Federation"
      },
      {
        "id": "",
        "name": "Gaming"
      },
      {
        "id": "",
        "name": "Technology"
      }
    ]
  },
  "external_refs": [
    "https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/",
    "https://otx.alienvault.com/pulse/6788e84c6e49a46074e0b726"
  ]
}