SecuriTricks - soho routers

Botnet Loader-as-a-Service Infrastructure Distributing RondoDoX and Mirai Payloads

A sophisticated botnet operation employing a Loader-as-a-Service model was uncovered through exposed command and control logs spanning six months. The campaign systematically targets SOHO routers, IoT devices, and enterprise applications through command injection vulnerabilities in web interfaces. …

command injection

iot

Published: September 25, 2025

Linked vulnerabilities : CVE-2019-17574, CVE-2019-16759, CVE-2012-1823

Downloadable IOCs: 341

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

A threat actor nicknamed ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots. The actor targets more than 50 brands of SOHO routers, SSL VPNs, DVRs, and BMC controllers, possibly to collect exploited vulnerabilities. The infection chain involves exploiting CVE-2023…

Published: May 23, 2025

Linked vulnerabilities : CVE-2023-20118, CVE-2021-32030

Downloadable IOCs: 15

One Sock Fits All: The use and abuse of the NSOCKS botnet

The ngioweb botnet serves as the foundation for the NSOCKS criminal proxy service, maintaining over 35,000 bots daily across 180 countries. The botnet primarily targets SOHO routers and IoT devices, with two-thirds of proxies based in the U.S. NSOCKS utilizes over 180 'backconnect' C2 nodes to obsc…

Published: November 19, 2024

Downloadable IOCs: 59

Tag: soho routers

Attack reports

Botnet Loader-as-a-Service Infrastructure Distributing RondoDoX and Mirai Payloads

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

One Sock Fits All: The use and abuse of the NSOCKS botnet