Malwarehigh
New EnemyBot DDoS Botnet Borrows Exploit Code from Mirai and Gafgyt
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-10823 | An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111… | 8.8 | 78% | PoC ×2 | |
| CVE-2020-17456 | SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page | 9.8 | 74% | PoC ×2 | |
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-35394 | Remote Code Execution via Memory Corruption in Realtek Jungle SDK | 9.8 | 100% | KEVPoC | KEV |
| CVE-2022-27226 | A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel | 8.8 | 34% | PoC ×3 |
From the original article
2 min read at thehackernews.com
A threat group that pursues crypto mining and distributed denial-of-service (DDoS) attacks has been linked to a new botnet called Enemybot, which has been discovered enslaving routers and Internet of Things (IoT) devices since last month.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.