Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
Summary: On Dec. 5, 2019, Unit 42 researchers found a new Muhstik botnet variant that adds a scanner to attack Tomato routers for the first time, brute-forcing web authentication on TCP port 8080 using the default credentials admin:admin and root:admin. A Shodan search found more than 4,600 Tomato and TomatoUSB routers exposed on the internet, and the botnet, active since March 2018, also carries modules to scan for WordPress and Webuzo and to exploit a deserialization vulnerability in Oracle WebLogic Server.
What you should know: The botnet's entry point is a default password on firmware that users install themselves, and with roughly 4,600 exposed Tomato devices, each one that keeps admin:admin becomes another node for the cryptocurrency mining and DDoS attacks Unit 42 says Muhstik runs from its bots.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026