Mirai and Hoaxcalls Botnets Target Legacy Symantec Web Gateways
Summary: Unit 42 observed new Hoaxcalls and Mirai botnet campaigns exploiting a post-authentication remote code execution vulnerability in Symantec Secure Web Gateway 5.0.2.8, a product that reached end-of-life in 2015 and end-of-support-life in 2019. The Hoaxcalls samples surfaced on April 24, 2020, days after the vulnerability details were published, and a Mirai variant using the same exploit appeared in the first week of May, carrying no DDoS capability and instead propagating via credential brute force and the same RCE.
Why it matters: The exploit entered circulation only days after public disclosure, and the target is a gateway that stopped receiving support in 2019 - so the window between a published vulnerability and its weaponization is now measured in days, while the equipment sitting in your network may be years past its last patch.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026