{
  "name": "Inside Water Barghest's Rapid Exploit-to-Market Strategy for IoT Devices",
  "slug": "inside-water-barghests-rapid-exploit-to-market-strategy-for-iot-devices",
  "description": "Water Barghest, a cybercriminal group, has developed a highly automated system for exploiting and monetizing IoT devices. Their botnet, comprising over 20,000 devices as of October 2024, uses automated scripts to identify and compromise vulnerable IoT devices from public internet scan databases. Once compromised, the Ngioweb malware is deployed, running in memory and connecting to command-and-control servers. The entire process, from initial infection to listing the device on a residential proxy marketplace, can take as little as 10 minutes. Water Barghest targets various IoT devices from brands like Cisco, DrayTek, and Zyxel, using both n-day vulnerabilities and at least one zero-day exploit. Their sophisticated operation has allowed them to maintain a low profile while generating steady income through their cybercriminal activities.",
  "published": "2024-11-18T13:21:40+00:00",
  "created_at": "2024-11-18T13:21:40+00:00",
  "modified_at": "2024-11-18T15:38:03+00:00",
  "created_at_opencti": "2024-11-18T13:21:40+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-11-18",
    "botnet",
    "iot",
    "ngioweb",
    "proxy",
    "residential proxy marketplace",
    "vulnerability exploitation"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "remalexation.name"
      },
      {
        "id": "",
        "name": "recepatission.info"
      },
      {
        "id": "",
        "name": "prekudinish.com"
      },
      {
        "id": "",
        "name": "prenurevaty.info"
      },
      {
        "id": "",
        "name": "monobimefist.com"
      },
      {
        "id": "",
        "name": "misukumotist.info"
      },
      {
        "id": "",
        "name": "inoluvary.com"
      },
      {
        "id": "",
        "name": "exagenafy.com"
      },
      {
        "id": "",
        "name": "enidecikive.net"
      },
      {
        "id": "",
        "name": "disimunous.com"
      },
      {
        "id": "",
        "name": "antigutation.info"
      },
      {
        "id": "",
        "name": "underuvukent.com"
      },
      {
        "id": "",
        "name": "subonuker.name"
      },
      {
        "id": "",
        "name": "ultradomafy.net"
      },
      {
        "id": "",
        "name": "semiridinution-postepudency.com"
      },
      {
        "id": "",
        "name": "minixetepate.biz"
      },
      {
        "id": "",
        "name": "promexucate.com"
      },
      {
        "id": "",
        "name": "macrofocafify.org"
      },
      {
        "id": "",
        "name": "interocakate.com"
      },
      {
        "id": "",
        "name": "emelenalike.com"
      },
      {
        "id": "",
        "name": "antihicipate.com"
      },
      {
        "id": "",
        "name": "f95342caa61e77174fe7653eea60909b9db0102c27a0641e25cdc053689110ab"
      },
      {
        "id": "",
        "name": "f6d70464165e00de26127464a84919f20521aa4efbecfae41e75688f74436489"
      },
      {
        "id": "",
        "name": "eddd909b49f2fef023a7b6188b2ae70bbf1e25e85f5e4c84c19cc25641f17175"
      },
      {
        "id": "",
        "name": "e3344c598a984dc5dc8dc1d971da8dd9b7058c48288dc5ad063548fff61543a1"
      },
      {
        "id": "",
        "name": "e2423e93b84284890a27e3796491049a22f6496b3830e20e808dff1c77560e3d"
      },
      {
        "id": "",
        "name": "e0cdaaba90f061d31cfe0211fe207cb3971970a141d9d72f95c8a55c8d565cb1"
      },
      {
        "id": "",
        "name": "c267e0bf3f1a0448e66427d5863d762af7cd6cc7ff812e6addcd4e54d9a46ac9"
      },
      {
        "id": "",
        "name": "bfab45d715e0e090ea18849661ed3ed58bdd7310c54c4a14a607eee4cc742e33"
      },
      {
        "id": "",
        "name": "be285b77211d1a33b7ae1665623a9526f58219e20a685b6548bc2d8e857b6b44"
      },
      {
        "id": "",
        "name": "b9360f1434ce7ff45b3ca49ff7269293188a339747b03bcd395b71b1d179700f"
      },
      {
        "id": "",
        "name": "b8385ce60ca6c69b7ea67fa93c7d5908809658e7d8a4fb9e003890b820979f53"
      },
      {
        "id": "",
        "name": "a8f7eaf999eb6cc8461f785fad13da30315da80b534cae047c5811bbea3351e3"
      },
      {
        "id": "",
        "name": "a8497257d78ea15088e0b9c68319a2c0ae8c651ed36780e9424effe97f440c0c"
      },
      {
        "id": "",
        "name": "a79ff2cd7f47b11d9176c40f0e82ba9b378c463ff9dd6e3e907df9480c7a1547"
      },
      {
        "id": "",
        "name": "a3317844f3d6b5b2440be896b84fd6aa4ee77a0f9b656b784b235e077b69715d"
      },
      {
        "id": "",
        "name": "9fead901a3012825841cb6091f52e0a914944fbb1460c3ddb9d07213fbb7e30e"
      },
      {
        "id": "",
        "name": "9fda16ad1d32f34c221d0e074a4ef13217eded63b5ff507452c4e2bbb57df3a4"
      },
      {
        "id": "",
        "name": "9fb33a16762dce934e7a48946e396ad672ab16d42a060021238f2ddf6a9f0514"
      },
      {
        "id": "",
        "name": "9f1fcfb2fcc66f4e534d3348b8d01eef0be1b153bc022ae7601ed3a0817aae88"
      },
      {
        "id": "",
        "name": "9cb6c49173e4cb5a0b3c2f6d69a5bdc0bc67138329f00afaf38d678f2c0e00a6"
      },
      {
        "id": "",
        "name": "97cadc2eba1eaa7a4115ea7cc82a6955bc69d8e2913b0b46f493f9cc84ec07de"
      },
      {
        "id": "",
        "name": "892eb161254733cf5923313544e923fface375c27b3dcf8f66e79da84c93cf65"
      },
      {
        "id": "",
        "name": "869965781d96a06741c2a28c54bb8e3233bc10fcb92455e6cb9ab0c9fc2c54d4"
      },
      {
        "id": "",
        "name": "83cf89428e07a1a10b22958dca25f50a8a151bccfa01ee9bcce870303a4f9861"
      },
      {
        "id": "",
        "name": "7bddb716c233211fa7332586e7d3e859814ec508108fa1024c4fb99aab843cdf"
      },
      {
        "id": "",
        "name": "78a1b5bea50034e7a03e6ed5c0f4f80f1fbc770555891a73790e1b59a2fba608"
      },
      {
        "id": "",
        "name": "74f4d77bf367063bccece2fb3796e6bd7a1f51528f58ed3f1450b7de6c29b5f4"
      },
      {
        "id": "",
        "name": "743f7c495048d8983bbedc3d52ea00c914fe008b06ef01c1be2a78cd5c1375f3"
      },
      {
        "id": "",
        "name": "710e0317de732f1bce32ed96d33468cb2b55e513106393b11bf7800081f1e681"
      },
      {
        "id": "",
        "name": "6a3288b1d326290778544769ea7c1ed80af763ea47fee5131afef209a0e2d301"
      },
      {
        "id": "",
        "name": "600c56a175f3661f434d1fe3418fb4cca96cdf6f880bd74a389e0d16d85ca501"
      },
      {
        "id": "",
        "name": "5d89b09dfb7c09a3a42345a136293b469a71ef7a1f599102ad67c09dc4fc53bf"
      },
      {
        "id": "",
        "name": "56657300f250fa9df77d6bc393bfc01d585d00bfb5302bf34314368fb13cbe26"
      },
      {
        "id": "",
        "name": "5353228926aa96b546b33de4418f15e347441d16d292f4946beca6a0d314e635"
      },
      {
        "id": "",
        "name": "4e8a36f467f1dab1b4768f67efd3712562699603839e38d93525c90989a4cf26"
      },
      {
        "id": "",
        "name": "4af537b29c54f976801ee7688c4db78d4b4e7b9947769226afc108e4645cf20f"
      },
      {
        "id": "",
        "name": "35f95fbb1b439a89cbd6e825188fb64fde44aef9829d549b4f547850552e095c"
      },
      {
        "id": "",
        "name": "2e940e3bd88226cfbbfb7a2eefbdd675173fd2950847a9131e11c1682353e286"
      },
      {
        "id": "",
        "name": "2bf2c10332f1d31e1b87e62ca2d7afc70f073c55474d7f03ff6c37caec28df4a"
      },
      {
        "id": "",
        "name": "1fe1cece08fef19448a32a746f5c8f77521db757c2b345103834a5f617101f15"
      },
      {
        "id": "",
        "name": "1748978997d9630c568f6c06ff0767ed8b0cfbf5c93612daf600adefecfba2e1"
      },
      {
        "id": "",
        "name": "129693d8c474a8de8f91e1d16e0129732aba20bea9ac24e7c68b345b7b05ad6f"
      },
      {
        "id": "",
        "name": "05cd00f975bd2522d943e836ef5a1cb00806c6d684987274da850be348b2b1f4"
      },
      {
        "id": "",
        "name": "db1f96b20679f9fb9cbd96b242ab8530102c0105b64c83c3ae544f87594a6fa9"
      },
      {
        "id": "",
        "name": "c91795b59248562e44d6c07526c7ab89dfe45344293703a94a3ae5ff02eab5a4"
      }
    ],
    "malware": [
      {
        "id": "0c59be0f-4567-409e-bf14-072c0447a192",
        "name": "ngioweb",
        "slug": "ngioweb"
      }
    ],
    "intrusion_sets": [
      {
        "id": "ee0650b0-640f-40a2-a51e-6322ca8c18b1",
        "name": "Water Barghest",
        "slug": "water-barghest"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "53b3b18c-d0d0-4bf6-bc6b-2c0ab9180deb",
        "name": "T1070"
      },
      {
        "id": "7abb6e8c-d357-49ef-9244-017043055224",
        "name": "T1205"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "c340d47a-2ea8-41ca-9a0b-a72559b89bbf",
        "name": "T1584"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/en_us/research/24/k/water-barghest.html",
    "https://otx.alienvault.com/pulse/673b4d74f0567c0115bd2c97"
  ]
}