Mass Campaign of Murdoc Botnet Mirai: A New Variant of Corona Mirai | Qualys
Summary: Qualys' Threat Research Unit reported an ongoing Mirai variant it calls Murdoc Botnet, active since July 2024, exploiting CVE-2024-7029 and CVE-2017-17215 to compromise AVTECH cameras and Huawei HG532 routers. The researchers found roughly 1,300 active IPs, more than 100 distinct C2 servers, and over 500 samples combining ELF binaries and shell scripts, with Malaysia, Thailand, Mexico, and Indonesia the most affected countries.
Why it matters: More than 100 command-and-control servers distributing a Mirai variant built from two known exploits means unpatched cameras and routers remain a standing recruitment pool for DDoS capacity - and the same shell-script delivery chain will run against any device that still answers.
Read the original at Qualys Blog ↗
- Topics
- Malware
- Mentions
- CVE-2017-17215CVE-2024-7029
- Related