‘Bashlite’ Malware Leverages ShellShock In BusyBox Attack

Researchers at Trend Micro are warning that a new version of the Bashlite malware is using the ShellShock vulnerability (CVE-2014-6271) to gain control of devices using BusyBox.

BusyBox is built on top of the Linux kernel and is used by devices such as routers. According to Trend Micro, recent samples of Bashlite (ELF_BASHLITE.SMB) scan networks for devices and machines running on BusyBox, logs in using a set of usernames and passwords, and then runs a command to download and run bin.sh and bin2.sh scripts to gain control over the BusyBox system.