Threats Day Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories
Summary: Fortinet reported that the Mirai-based ShadowV2 botnet infected IoT devices across industries and continents, active only during the late October 2025 AWS outage and assessed as likely a test run for future attacks, exploiting flaws including CVE-2009-2765, CVE-2024-10914, CVE-2024-10915, CVE-2023-52163, CVE-2024-3721, and CVE-2024-53375. A second Mirai-based botnet, RondoDox, has weaponized over a dozen exploits against IoT devices, while ESET disclosed the QuietEnvelope toolset targeting OpenFind MailGates with three backdoors and debug strings in simplified Chinese.
Key Takeaway: ShadowV2's operators used a real AWS outage as cover for what Fortinet assesses was a test run, meaning the next campaign may not be a drill and your unpatched D-Link, TP-Link, or DigiEver gear is the recruitment pool.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2009-2765CVE-2020-25506CVE-2022-37055CVE-2023-52163CVE-2024-10914CVE-2024-10915CVE-2024-3721CVE-2024-53375
- Related
- Threats Day Bulletin: Spyware Alerts, Mirai Strikes, Docker Leaks, ValleyRAT Rootkit — and 20 More Stories Cyber Risks ·CVE-2023-52163: Digiever DS-2105 Pro Missing Authorization Vulnerability Known Exploited Vulnerabilities · Dec 22, 2025CVE-2022-37055: D-Link Routers Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Dec 08, 2025