Cayosin

Cayosin is a type of malware, a harmful software designed to exploit and damage computer systems or devices. It has been deployed by the Diicot cybercrime group in a new campaign, according to research from Cado Labs. Traditionally associated with cryptojacking campaigns, Diicot has shifted tactics, deploying an off-the-shelf Mirai-based botnet agent named Cayosin. The primary targets of this campaign are internet-exposed SSH servers with password authentication enabled. If a compromised system runs OpenWRT, a Linux-based open-source operating system for networking devices, the attackers deploy a script that determines the device CPU architecture and deploys a Cayosin binary compiled for that architecture. The Cayosin botnet has been specifically employed to target routers running the Linux-based embedded devices operating system OpenWrt. Researchers have found evidence that Diicot threat actors are expanding their capabilities with new payloads and the Cayosin Botnet. In instances where the malware encounters an OpenWrt router, a Mirai-style spreader script called “bins.sh” is launched to retrieve the Cayosin botnet agent’s binaries. This indicates a shift in the group's attack style, showing adaptability based on their targets. Earlier this year, researchers from Akamai noted a change in the group's name and a diversification of its attack toolkit. This included the addition of an SSH worm written in Golang and the deployment of a Mirai variant called Cayosin. The development and distribution of these malware families, such as Cayosin and Qbot, demonstrate the increasingly sophisticated strategies of cybercriminals, who often sell and redistribute these tools as a service. As a result, it is crucial to remain vigilant and maintain robust cybersecurity measures to counter these threats.