Malwarecritical

Moobot botnet spreads by targeting Cacti and RealTek flaws

Security Affairsby @securityaffairsApr 3, 2023 · 07:45 UTC (Apr 3, 2023)2 min read2 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-46169 CVE-2021-35394 CVE-2021-36260

Tags: cve-2022-46169 cve-2021-35394 cve-2021-36260 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-35394	Remote Code Execution via Memory Corruption in Realtek Jungle SDK	9.8	100%	KEVPoC	Aug 16, 2021 KEV Dec 10, 2021
CVE-2021-36260	Unauthenticated Command Injection in Hikvision Device Web Server	9.8	100%	KEVPoC ×3	Sep 22, 2021 KEV Jan 10, 2022
CVE-2022-46169	Unauthenticated Command Injection in Cacti (CVE-2022-46169)	9.8	100%	KEVPoC	Dec 5, 2022 KEV Feb 16, 2023

From the original article

2 min read at securityaffairs.com

The Moobot botnet is actively exploiting critical vulnerabilities in Cacti, and Realtek in attacks in the wild. FortiGuard Labs researchers observed an ongoing hacking campaign targeting Cacti ( CVE-2022-46169 ) and Realtek ( CVE-2021-35394 ) vulnerabilities to spread ShellBot and Moobot malware. The ShellBot , also known as PerlBot, is a Perl-based DDoS bot that uses IRC protocol for C2 communications.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.