Researchers from FortiGuard Labs have discovered a new IoT botnet tracked as RapperBot which is active since mid-June 2022. The bot borrows a large portion of its code from the original Mirai botnet, but unlike other IoT malware families, it implements a built-in capability to brute force credentials and gain access to SSH servers instead of Telnet as implemented in Mirai.
Experts also noticed that the most recent samples include the code to maintain persistence, which is rarely implemented in other Mirai variants.
RapperBot has limited DDoS capabilities, it was designed to target ARM, MIPS, SPARC, and x86 architectures.
