Loading story…
Cybersecurity researchers have reported a significant surge in automated attacks against PHP servers, IoT devices, and cloud gateways, primarily orchestrated by botnets such as Mirai, Gafgyt, and Mozi. These campaigns exploit a range of known vulnerabilities—including CVE-2017-9841 (PHPUnit), CVE-2021-3129 (Laravel), and CVE-2022-47945 (ThinkPHP)—as well as cloud misconfigurations and insecure deployments. The widespread use of PHP-based content management systems like WordPress and Craft CMS, combined with common misconfigurations and outdated plugins, has expanded the attack surface, making these environments especially attractive to threat actors seeking remote code execution or data theft opportunities.
Attackers are also leveraging insecure debugging tools, such as leaving Xdebug active in production, and are actively searching for exposed credentials, API keys, and AWS secrets on internet-facing servers. IoT devices remain a persistent weak link, with vulnerabilities like CVE-2022-22947 (Spring Cloud Gateway) and CVE-2024-3721 (TBK DVR-4104/4216) being targeted to conscript devices into botnets. The Qualys Threat Research Unit emphasizes that the combination of known software flaws and misconfigurations continues to drive the growth of large-scale botnet activity, posing ongoing risks to enterprises and cloud environments.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Security experts accompanying the Qualys findings warned that adversaries are increasingly pivoting beyond traditional IT into cloud infrastructure, IoT, OT, and IoMT devices. They said exposed APIs, default credentials, vulnerable firmware, and end-of-life devices are enabling low-cost scaling, credential theft, ransomware delivery, and botnet expansion.
The Qualys report said attackers were abusing query strings to trigger Xdebug debugging sessions on PHP servers, allowing data extraction from exposed environments. This highlighted insecure development tooling left enabled in production as an active attack vector.
Qualys Threat Research Unit reported a significant increase in automated attacks targeting web-exposed PHP servers, IoT devices, and cloud gateways. The report linked the activity to established botnets including Mirai, Gafgyt, and Mozi, exploiting known vulnerabilities and misconfigurations for remote code execution, data theft, and secondary malware delivery.
Netscout identified the Aisuru botnet as TurboMirai malware and said it could enable distributed denial-of-service attacks exceeding 20 Tbps. This assessment provided context for the scale and capability of modern Mirai-derived botnet activity.
Threat actors began exploiting the TBK DVR-4104/DVR-4216 command injection vulnerability CVE-2024-3721 as part of automated botnet intrusions against IoT devices. The flaw provided another path for Mirai, Mozi, and Gafgyt ecosystem operators to compromise exposed DVRs.
Botnet activity was reported abusing an MVPower DVR misconfiguration and backdoor exposure to compromise IoT devices. Mirai-linked operators used these weaknesses to add vulnerable DVRs to botnet capacity.
Attackers incorporated exploitation of Spring Cloud Gateway remote code execution vulnerability CVE-2022-22947 into campaigns against cloud gateways and cloud-native environments. The activity enabled compromise of exposed services and supported follow-on malware delivery and botnet growth.
Botnet operators were reported exploiting long-known remote code execution vulnerabilities in PHPUnit (CVE-2017-9841), Laravel Ignition (CVE-2021-3129), and ThinkPHP (CVE-2022-47945) to compromise internet-exposed PHP servers running platforms such as WordPress and Craft CMS. These weaknesses were used to seize control of servers and expand botnet infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourceinfosecurity-magazine.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
New variants of the **Mirai** and **Gafgyt** IoT/Linux botnets were observed expanding from consumer devices to enterprise-facing systems by exploiting known vulnerabilities in **Apache Struts** and **SonicWall Global Management System**. Palo Alto Networks Unit 42 reported that a Mirai sample targeted `CVE-2017-5638`, the remote code execution flaw in Apache Struts tied to the Equifax breach, marking the first known case of Mirai using that exploit in the wild. A Gafgyt variant was also seen exploiting `CVE-2018-9866` in older, unsupported SonicWall GMS versions shortly after a Metasploit module for the bug became public. Researchers linked both malware families through infrastructure involving **l[.]ocalhost[.]host** and said the Mirai sample carried 16 exploits in total, while the Gafgyt sample included scanning and DDoS capabilities such as **Blacknurse**, underscoring a broader shift by IoT/Linux botnets toward outdated enterprise targets.
Aug 14, 2026