Exploit / PoCcritical
IoT under siege: The return of the Mirai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-12856 | OS Command Injection in Four-Faith F3x24/F3x36 Routers | 7.2 | 84% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cross-compiling.org | emboy connects to its C2 by resolving random domains (e.g., cross-compiling[.]org , furry-femboys[.]top ) via public DNS (1.1.1.1, 8.8.8.8) |
| domain | furry-femboys.top | by resolving random domains (e.g., cross-compiling[.]org , furry-femboys[.]top ) via public DNS (1.1.1.1, 8.8.8.8) to evade local filter |
| ipv4 | 1.1.1.1 | oss-compiling[.]org , furry-femboys[.]top ) via public DNS (1.1.1.1, 8.8.8.8) to evade local filtering. It scans 15 ports to es |
| ipv4 | 87.121.84.34 | ploiting multiple device flaws. Attacks originated from IPs 87[.]121[.]84[.]34 and 220[.]158[.]234[.]135. The experts identified the |
| ipv4 | 8.8.8.8 | ling[.]org , furry-femboys[.]top ) via public DNS (1.1.1.1, 8.8.8.8) to evade local filtering. It scans 15 ports to establish c |
From the original article
2 min read at securityaffairs.com
Mirai-based Gayfemboy botnet resurfaces, evolving to target systems worldwide; Fortinet researchers provided details about the new campaign. FortiGuard Labs researchers tracked a new Gayfemboy botnet campaign, the malware exploits known flaws in DrayTek, TP-Link, Raisecom, and Cisco, showing evolved tactics and renewed activity.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.