Malware
Nosedive
According to Black Lotus Labs, Nosedive is a custom variation of the Mirai implant that is supported on all major SOHO and IoT architectures (e.g.
Nosedive is a Linux malware family operated by Flax Typhoon.
Background
Black Lotus Labs characterizes Nosedive as a bespoke fork of the Mirai implant that runs on every major SOHO and IoT architecture (MIPS, ARM, SuperH, PowerPC, and so on). Within the Raptor Train infrastructure, Nosedive implants are usually pushed from Tier 2 payload servers using a distinctive URL encoding scheme and domain injection technique. The Nosedive droppers request payloads for particular C2s by encoding the desired C2 domain and pairing it with a unique "key" that pins down both the bot and the architecture of the infected device (MIPS, ARM, etc.), which is then injected into the implant payload sent to the Tier 1 node. After deployment, Nosedive operates strictly in memory, letting operators run commands, transfer files in either direction, and launch DDoS attacks from the compromised devices.
Both the malware and its droppers exist only in memory and are wiped from disk. Combined with anti-forensics measures on the devices, such as masking running process names, a multi-stage infection chain, and terminating remote management processes, this makes detection and investigation considerably harder.
Source: Malpedia (Fraunhofer FKIE).