Malwarehigh
Updated - The new Wicked Mirai botnet leverages at least three new exploits
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-6277 | Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers | 8.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2018-10561 | Authentication Bypass in Dasan GPON Home Routers (CVE-2018-10561) | 9.8 | 93% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.246.152.173 | ts payload from a malicious web site , in this case, hxxp://185[.]246[.]152[.]173/exploit/owari.{extension}. This makes it obvious that |
| url | http://185.246.152.173/exploit/owari.{extension} | loads its payload from a malicious web site , in this case, hxxp://185[.]246[.]152[.]173/exploit/owari.{extension}. This makes it obvious that it aims to download the O |
From the original article
4 min read at securityaffairs.com
Security experts from Fortinet have spotted a new variant of the Mirai botnet dubbed ‘Wicked Mirai’, it includes new exploits and spread a new bot. The name Wicked Mirai comes from the strings in the code, the experts discovered that this new variant includes at least three new exploits compared to the original one.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.