Vulnerability (CVE)
360 Netlab discovered a new Mirai-derived malware family named Satori in early December 2017, and Palo Alto Networks Unit 42 identified three variants, the first appearing in April 2017. The third variant exploited CVE-2017-17215, a Huawei HG532e home...
Unit 42 reported three malware campaigns built on publicly available Mirai and Gafgyt source code that emerged at the end of May 2018, with samples carrying as many as eleven exploits in a single sample - more than the IoT Reaper malware's nine. One...
Unit 42 found new variants of the Mirai and Gafgyt IoT botnets, including a Mirai sample discovered on September 7, 2018 that carries exploits for 16 vulnerabilities and is the first known instance of Mirai targeting an Apache Struts flaw, CVE-2017-5638. A...
In late February 2019, Unit 42 discovered Mirai samples compiled for four processors not previously targeted: Altera Nios II, OpenRISC, Tensilica Xtensa, and Xilinx MicroBlaze. The samples were hosted on a single IP, 178.62.227[.]13, which also hosted...
VMware published advisory VMSA-2022-0011 on April 6, 2022 covering eight vulnerabilities including CVE-2022-22954, a server-side template injection remote code execution flaw in Workspace ONE Access and Identity Manager that Unit 42 says is trivial to...
Unit 42 discovered an updated Gafgyt variant, derived from the JenX botnet, that exploits remote code execution flaws in Zyxel P660HN-T1A, Huawei HG532, and Realtek RTL81XX wireless routers to recruit them into a botnet. The variant combines...
Qualys' Threat Research Unit reported an ongoing Mirai variant it calls Murdoc Botnet, active since July 2024, exploiting CVE-2024-7029 and CVE-2017-17215 to compromise AVTECH cameras and Huawei HG532 routers. The researchers found roughly 1,300 active...