Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, Sonic Wall
Summary: Unit 42 found new variants of the Mirai and Gafgyt IoT botnets, including a Mirai sample discovered on September 7, 2018 that carries exploits for 16 vulnerabilities and is the first known instance of Mirai targeting an Apache Struts flaw, CVE-2017-5638. A Gafgyt variant hosted on the same domain, which resolved to 185[.]10[.]68[.]127 during part of August 2018, exploited CVE-2018-9866 in older SonicWall Global Management System versions (8.1 and older), with samples surfacing August 5, less than a week after a Metasploit module for the vulnerability was published.
Why it matters: These botnets built for consumer devices are now carrying exploits for enterprise software like Apache Struts and SonicWall GMS, and the Gafgyt sample appeared within days of a public Metasploit module - so the window between a patch and an attack keeps shrinking for any organization still running outdated, unsupported versions.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-17215CVE-2017-5638CVE-2018-9866
- Related
- CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021