Ballista Botnet Exploits Unpatched TP-Link Vulnerability, Targets Over 6,000 Devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data. Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic. | 8.8 | 100% | KEV PoC ×2 |
| masslikely hundreds of thousands of routers deployed, with >100k plausibly internet-exposed |
Full article513 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 11, 2025Network Security / Vulnerability
Unpatched TP-Link Archer routers have become the target of a new botnet campaign dubbed Ballista, according to new findings from the Cato CTRL team.
"The botnet exploits a remote code execution (RCE) vulnerability in TP-Link Archer routers (CVE-2023-1389) to spread itself automatically over the Internet," security researchers Ofek Vardi and Matan Mittelman said in a technical report shared with The Hacker News.
CVE-2023-1389 is a high-severity security flaw impacting TP-Link Archer AX-21 routers that could lead to command injection, which could then pave the way for remote code execution.
The earliest evidence of active exploitation of the flaw dates back to April 2023, with unidentified threat actors using it to drop Mirai botnet malware. Since then, it has also been abused to propagate other malware families like Condi and AndroxGh0st.
Cato CTRL said it detected the Ballista campaign on January 10, 2025. The most recent exploitation attempt was recorded on February 17.
The attack sequence entails the use of a malware dropper, a shell script ("dropbpb.sh") that's designed to fetch and execute the main binary on the target system for various system architectures such as mips, mipsel, armv5l, armv7l, and x86_64.
Once executed, the malware establishes an encrypted command-and-control (C2) channel on port 82 in order to take control of the device.
"This allows running shell commands to conduct further RCE and denial-of-service (DoS) attacks," the researchers said. "In addition, the malware attempts to read sensitive files on the local system."
Some of the supported commands are listed below -
- flooder, which triggers a flood attack
- exploiter, which exploits CVE-2023-1389
- start, an optional parameter that is used with the exploiter to start the module
- close, which stops the module triggering function
- shell, which runs a Linux shell command on the local system.
- killall, which is used to terminate the service
In addition, it's capable of terminating previous instances of itself and erasing its own presence once execution begins. It's also designed to spread to other routers by attempting to exploit the flaw.
The use of the C2 IP address location (2.237.57[.]70) and the presence of Italian language strings in the malware binaries suggests the involvement of an unknown Italian threat actor, the cybersecurity company said.
That said, it appears the malware is under active development given that the IP address is no longer functional and there exists a new variant of the dropper that utilizes TOR network domains instead of a hard-coded IP address.
A search on attack surface management platform Censys reveals that more than 6,000 devices are targeted by Ballista. The vulnerable devices are concentrated around Brazil, Poland, the United Kingdom, Bulgaria, and Turkey.
The botnet has been found to target manufacturing, medical/healthcare, services, and technology organizations in the United States, Australia, China, and Mexico.
"While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi," the researchers said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/ballista-botnet-exploits-unpatched-tp.html