Cyber Risks · Unit 42 Palo Alto Networks

Mirai Variant Moo Bot Targeting D-Link Devices

Summary: Unit 42 researchers discovered attacks in early August exploiting four known D-Link vulnerabilities to spread MooBot, a Mirai variant that targets exposed Linux networking devices. Successful exploitation lets attackers fully control the devices, which use wget to download MooBot binaries from host 159.203.15[.]179 and can then be conscripted into DDoS botnets.
Why it matters: The exploited flaws carry low attack complexity but critical impact, and D-Link has published bulletins for all four, meaning unpatched or older devices remain exposed to remote code execution and botnet recruitment.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: OT / ICS & Critical Infrastructure
Mentions: CVE-2015-2051 CVE-2018-6530 CVE-2022-26258 CVE-2022-28958
Related: CVE-2018-6530: D-Link Multiple Routers OS Command Injection Vulnerability Known Exploited Vulnerabilities · Sep 08, 2022
CVE-2022-26258: D-Link DIR-820L Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Sep 08, 2022
CVE-2015-2051: D-Link DIR-645 Router Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022