Tag: soho routers

2 Attack Reports | 0 Vulnerabilities

Attack reports

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

A threat actor nicknamed ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots. The actor targets more than 50 brands of SOHO routers, SSL VPNs, DVRs, and BMC controllers, possibly to collect exploited vulnerabilities. The infection chain involves exploiting CVE-2023…
gobrat
edge devices
soho routers
honeypot
CVE-2023-20118
2025-05-23
netghost
CVE-2021-32030
Published: May 23, 2025
Linked vulnerabilities : CVE-2023-20118, CVE-2021-32030
Downloadable IOCs: 15

One Sock Fits All: The use and abuse of the NSOCKS botnet

The ngioweb botnet serves as the foundation for the NSOCKS criminal proxy service, maintaining over 35,000 bots daily across 180 countries. The botnet primarily targets SOHO routers and IoT devices, with two-thirds of proxies based in the U.S. NSOCKS utilizes over 180 'backconnect' C2 nodes to obsc…
ddos
botnet
cybercrime
ngioweb
2024-11-19
nsocks
proxy service
soho routers
shopsocks5
iot devices
vn5socks
Published: November 19, 2024
Downloadable IOCs: 59
Click here to see more Attack Reports