New Mirai Worm Knocks 900K Germans Offline
Summary: More than 900,000 Deutsche Telekom customers were knocked offline after their routers were infected by a new Mirai variant that exploited a flaw in the TR-069 remote firmware upgrade feature on Port 7547 in Zyxel and Speedport DSL modems. The malware closes Port 7547 and kills the telnet service once it infects a device, blocking the ISP's remote updates, and SANS research found vulnerable devices compromised within five to ten minutes of connecting to the Internet.
What you should know: A Shodan scan suggests as many as five million devices are vulnerable to the same exploit, and Flashpoint's Allison Nixon says the botnet behind this variant is likely rented out in chunks as a commercial service, with redundant control infrastructure built to survive takedowns.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026