A fast-evolving new botnet could take gadgets in your home to the dark side

There’s a new botnet in town. Since December, security researchers have been tracking an insidious piece of malware called Satori, which hijacks internet-connected devices and turns them into “zombies” that can be remotely controlled in unison. The number of devices in its thrall is still small. But whoever’s behind it is working quickly to tweak its design, hoping to build a powerful army of machines that can be summoned to pump out masses of e-mail spam, incapacitate corporate websites, or even bring down large chunks of the internet itself.

Satori, whose name means “enlightenment” in Japanese, has dark origins. Some of its source code appears to be the same as that of Mirai, a botnet that in 2016 used hundreds of thousands of compromised routers, web-connected cameras, and other devices to send out a flood of data traffic that overwhelmed some key internet infrastructure in America. That attack temporarily took down the sites of a number of prominent companies, including Twitter, the New York Times, and Airbnb.

The authors of Mirai have since been caught, but their creation has clearly inspired others to follow in their footsteps. “It’s obvious that Satori is under active development,” says Matt Bing of NetScout Arbor, a cybersecurity firm.

As a result, it’s been evolving quickly. It began by targeting routers in Latin America and Egypt. When internet service providers in those places blocked it late last year, a new variant appeared, aimed at computers mining digital currency. Now it’s morphed again. The latest version targets software associated with ARC processors, which provide the silicon brains for a wide range of internet-of-things devices, including some smart thermostats, digital TV set-top boxes, and car infotainment systems.

After finding a weak point in a device’s defenses, Satori probes to see if the owner has kept default passwords and settings, hoping to exploit these to gain control of the machine. If it succeeds, it then looks for other devices on a network and tries to infect them too.

Dale Drew, chief security strategist at CenturyLink, a network services provider that’s been tracking Satori, says the botnet currently comprises perhaps no more than 40,000 devices. But he notes that the (still unknown) author of the malware is “pretty disciplined in identifying new tactics and techniques” to compromise machines. If the zombie master is successful in targeting the internet of things more broadly, he or she could end up building a botnet that’s even bigger than Mirai.