Search: “soap”

24 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 49 Malware 24 Exploit / PoC 16 Ransomware 11 Policy & legal 8 Data breach 6 Threat actor 5 Industry 4 Research 4 AI tools & infra 3 Advisory 2 Tools 2 Phishing & fraud 1 AI research 1

SeverityAll critical 55 high 45 medium 12 low 14 info 10

Mirai Variant MooBot Targeting D

Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.

Unit 42 captured attacks exploiting four D-Link remote code execution vulnerabilities: CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958, with three rated critical at CVSS 9.8. The exploits download the MooBot malware, a Mirai botnet variant, from infrastructure at 159.203.15.179 via wget. Compromised devices fall under full attacker control and can be used for distributed denial-of-service attacks. D-Link has published bulletins for all four flaws, but unpatched devices remain exposed.

Palo Alto Unit 42Aug 17, 13:06 UTC · Aug 17, 2026Malware in the wildCVE-2015-2051 CVE-2018-6530 CVE-2022-26258+1 CVEs

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42Aug 19, 12:03 UTC · 28d agoMalware1

Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns

Palo Alto Unit 42Mar 8, 18:14 UTC · Mar 8, 2019Malware CVE-2018-10561 CVE-2018-1562 CVE-2018-10562+2 CVEs

VERMIN: Quasar RAT and Custom Malware Used In Ukraine

Palo Alto Unit 42Jan 29, 13:00 UTC · Jan 29, 2018Malware

Satori's threat actors are behind the new Masuta botnet that is targeting routers in the wild

Security AffairsJan 27, 18:41 UTC · Jan 27, 2018Malware

Hajime, the mysterious evolving botnet

Kaspersky SecurelistApr 25, 08:58 UTC · Apr 25, 2017Malware

JenX botnet leverages Grand Theft Auto videogame community to infect devices

Security AffairsFeb 3, 11:59 UTC · Feb 3, 2018Malware CVE-2017-17215 CVE-2014-8361

Heads of the Hydra. Malware for Network Devices

Kaspersky SecurelistAug 16, 11:27 UTC · Aug 16, 2011Malware

Home & Small Office Wireless Routers Exploited to Attack Gaming Servers

Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.

Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.

Palo Alto Unit 42Aug 18, 04:46 UTC · 29d agoMalware in the wildCVE-2017-18368 CVE-2017-17215 CVE-2014-83611