ViciousTrap
ViciousTrap is a threat actor tracked by Sekoia.io that has compromised roughly 5,300-5,500 internet-facing network edge devices across 84 countries and repurposed them into a honeypot-like interception network. Sekoia first observed the activity in March 2025. The actor primarily exploited CVE-2023-20118 affecting Cisco Small Business/SOHO routers, and Sekoia also observed activity targeting ASUS routers via CVE-2021-32030. GreyNoise assessed that a March 2025 ASUS router campaign it tracks as AyySSHush is very likely the same actor as ViciousTrap. The actor’s tradecraft includes a shell-scripted infection chain that downloads a BusyBox wget binary, then retrieves and executes a self-deleting second-stage script referred to as NetGhost. NetGhost checks ports 80, 8000, and 8080, clears existing NAT redirection rules, and installs iptables NAT rules to forward inbound traffic to attacker-controlled infrastructure. It also registers compromised devices by sending HTTP requests containing the redirected port and a victim UUID. Sekoia assessed this setup enables man-in-the-middle/adversary-in-the-middle style interception and functions as a distributed honeypot network. Sekoia also reported that the actor reused a previously documented PolarEdge-related webshell that had not been publicly released, suggesting the actor may obtain and repurpose tooling through traffic interception or observation. Victimology spans more than 50 brands and dozens of device types, including SOHO routers, SSL VPNs, DVRs, NAS devices, and BMC controllers. Reported targeted or affected brands include Cisco, D-Link, Linksys, Araknis Networks, ASUS, and QNAP. Sekoia reported that many compromised devices were end-of-life, with Macao notably heavily impacted, including widespread infections involving old D-LINK DIR-850L routers. Infrastructure observed by Sekoia was hosted in Malaysia in AS45839 operated by Shinjiru, and campaign components were correlated via a shared TLS certificate fingerprint. Attribution is not confirmed, but Sekoia assessed a likely Chinese-speaking origin based on weak overlap with GobRAT infrastructure and the geographic distribution of monitored and targeted assets. Known associated name: AyySSHush (GreyNoise malware/botnet name assessed as very likely linked to the same actor).
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
ViciousTrap initiates compromise by leveraging the Cisco SOHO router vulnerability, tracked as CVE-2023-20118, which enables command and bash script execution.
In particular it targets CVE-2023-39780, a nearly two-year-old command injection vulnerability with a "high" 8.8 rating in the Common Vulnerability Scoring System (CVSS).
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Compromised thousands of network edge devices globally by exploiting Cisco Small Business router CVE-2023-20118, building a honeypot-like network.
A campaign tracked by Sekoia targeting SOHO routers, as well as more than 50 manufacturers' devices, SSL VPNs, DVRs, and BMC controllers, turning them into honeypots.
Compromised thousands of edge devices (SOHO routers, SSL VPNs, DVRs, BMC controllers) and repurposed them at scale as distributed honeypots/monitoring nodes—likely to observe exploitation attempts, collect exploit tradecraft (potentially including non-public/0-day), and possibly reuse access obtained by other threat actors (also consistent with ORB-style infrastructure).
Threat actor observed compromising thousands of edge devices from Linksys, D-Link, QNAP, Araknis Networks, and ASUS, apparently to build a vast operational relay box (ORB) network.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.