Storm Watch | Cyber Podcast | Unforgivable Vulnerabilities & The Ballista Botnet Nightmare
Summary: GreyNoise's Storm Watch episode discusses the Ballista botnet, first detected on January 10, 2025, which exploits CVE-2023-1389 to target TP-Link Archer routers and has infected over 6,000 devices worldwide, with activity observed in mid-February. The episode also covers Steve Coley's 2007 paper on "Unforgivable Vulnerabilities" and its "Lucky 13" flaws, including buffer overflows, cross-site scripting, SQL injection, and hard-coded credentials.
What's compelling: Ballista is exploiting a vulnerability discovered two years ago to build encrypted command-and-control channels across more than 6,000 devices, and the actors behind it are believed to be based in Italy and have hit manufacturing, healthcare, services, and technology organizations in the US, Australia, China, and Mexico.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-1389
- Related
- CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability Known Exploited Vulnerabilities · May 01, 2023Threat Actors Actively Targeting LLMs Cyber Risks ·