Tag: mirai

10 Attack Reports | 0 Vulnerabilities

Attack reports

New Aquabot Variant Targeting Mitel SIP Phones

A new variant of the Mirai-based malware, Aquabot, dubbed Aquabotv3, is actively exploiting Mitel SIP phones through CVE-2024-41710. This variant introduces a novel feature for Mirai-based botnets: reporting back to the command and control server when kill signals are caught on infected devices. Th…

Published: January 29, 2025

Downloadable IOCs: 45

Mass Campaign of Murdoc Botnet Mirai: A New Variant of Corona Mirai

The Qualys Threat Research Unit has uncovered a large-scale operation within the Mirai campaign, dubbed Murdoc Botnet. This variant exploits vulnerabilities in AVTECH Cameras and Huawei HG532 routers, demonstrating enhanced capabilities to compromise devices and establish expansive botnet networks.…

Published: January 22, 2025

Downloadable IOCs: 0

IoT Botnet Linked to Large-scale DDoS Attacks Since the End of 2024

An IoT botnet has been orchestrating large-scale DDoS attacks globally since late 2024, targeting companies in Japan and other countries. The botnet, comprising Mirai and Bashlite variants, infects IoT devices by exploiting vulnerabilities and weak credentials. It uses various DDoS attack methods, …

Published: January 17, 2025

Downloadable IOCs: 0

Botnets Continue to Target Aging D-Link Vulnerabilities

Two botnets, FICORA and CAPSAICIN, have been exploiting long-standing vulnerabilities in D-Link routers to spread globally. FICORA, a Mirai variant, uses a shell script to download and execute malware on various Linux architectures, incorporating DDoS attack functions. CAPSAICIN, likely based on th…

Published: December 31, 2024

Downloadable IOCs: 51

Warning of a surge in activity associated with FICORA and Kaiten botnets

FortiGuard Labs researchers observed increased activity from two botnets in late 2024: the Mirai variant 'FICORA' and the Kaiten variant 'CAPSAICIN'. Both target vulnerabilities in D-Link devices, particularly through the HNAP interface, allowing remote command execution. The FICORA botnet download…

Published: December 27, 2024

Downloadable IOCs: 2

DigiEver Fix That IoT Thing!

In mid-November 2024, the Akamai SIRT discovered an uptick in activity targeting the URI /cgi-bin/cgi_main.cgi in our global network of honeypots. This activity appears to be part of a recent ongoing Mirai-based malware campaign dating back to at least October 2024. Further investigation into this …

Published: December 27, 2024

Downloadable IOCs: 32

Matrix Unleashes A New Widespread DDoS Campaign

A new widespread Distributed Denial-of-Service (DDoS) campaign orchestrated by a threat actor named Matrix has been uncovered. The operation combines public scripts, brute-force attacks, and exploitation of weak credentials to create a botnet capable of global disruption. Matrix targets vulnerabili…

vulnerability exploitation

Published: November 27, 2024

Downloadable IOCs: 12

People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations

PRC-linked cyber actors have compromised thousands of Internet-connected devices to create a botnet for malicious activities. Integrity Technology Group, a PRC-based company with government links, has controlled a botnet of over 260,000 devices since mid-2021. The botnet uses Mirai-based malware to…

cyber espionage

network compromise

Published: October 2, 2024

Downloadable IOCs: 169

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401

A critical security flaw in the Open Geospatial Consortium (OGC) GeoServer server has been exploited by cyber-attackers to gain control of vulnerable systems, according to FortiGuard Labs.

Published: September 10, 2024

Downloadable IOCs: 75

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation

Juniper Threat Labs has observed attempts to exploit Ivanti Pulse Secure authentication bypass and remote code execution vulnerabilities (CVE-2023-46805 and CVE-2024-21887), leading to the delivery of Mirai botnet payloads. This analysis explores the vulnerabilities, exploitation methods, observed …

Published: May 10, 2024

Downloadable IOCs: 23

Click here to see more Attack Reports