Grandstream and Dray Tek Devices Exploited to Power New Hoaxcalls DDoS Botnet
Summary: A new DDoS botnet dubbed Hoaxcalls, built on the Gafgyt/Bashlite codebase, is exploiting CVE-2020-8515 in Grandstream UCM6200 business telephone systems and CVE-2020-5722 in DrayTek Vigor routers, both rated CVSS v3.1 9.8 for trivial exploitability and allowing arbitrary command execution. Palo Alto Networks caught the first CVE-2020-8515 exploitation on March 31, 2020 at 13:51 UTC, and detected attack traffic has doubled since that date, with the bot communicating over IRC to C2 server 178[.]32[.]148[.]5 on TCP port 1337 in channel #hellroom.
What's compelling: Two critical-rated flaws in internet-facing phone systems and routers are being chained into a self-propagating botnet whose traffic doubled in the weeks after March 31 - and the malware was not on VirusTotal at the time of discovery.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2020-5722CVE-2020-8515
- Related
- CVE-2020-5722: Grandstream Networks UCM6200 Series SQL Injection Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022CVE-2020-8515: Multiple Dray Tek Vigor Routers Web Management Page Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026