Loading story…
A previously undisclosed flaw in Huawei enterprise router software was reportedly exploited to cause a nationwide telecom outage in Luxembourg, knocking out POST Luxembourg landline, 4G, 5G, and emergency communications for more than three hours. Investigators said specially crafted traffic passing through POST’s infrastructure forced Huawei routers into continuous reboot loops, and POST described the incident as a denial-of-service attack abusing a non-public, undocumented behavior rather than a conventional volumetric DDoS or any previously known vulnerability.
Authorities, Huawei, and European incident response partners reportedly coordinated on the case, but no public CVE or broad advisory has been issued and no criminal charges have been announced. Investigators found no evidence that POST Luxembourg was specifically targeted and no confirmed signs of wider exploitation, yet reporting indicates no patch was available at the time and it remains unclear whether the flaw has since been fully remediated or whether other telecom operators could still be exposed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In May 2026, media reports disclosed that the 2025 Luxembourg telecom crash was allegedly caused by a previously undisclosed Huawei router flaw. The reporting noted it remains unclear whether the issue was fully patched or whether other operators are still exposed.
Following the outage, Luxembourg authorities, Huawei, and European incident response partners reportedly coordinated on the incident. In the months after the event, no public CVE, broad warning, or criminal charges were issued, and no additional exploitation was confirmed.
Investigators determined that specially crafted traffic traversing POST Luxembourg’s infrastructure caused Huawei enterprise routers to enter continuous reboot loops. POST described the incident as a denial-of-service attack exploiting a non-public, undocumented behavior with no patch available at the time.
On July 23, 2025, POST Luxembourg suffered a nationwide outage that disrupted landline, 4G, 5G, and emergency communications for more than three hours.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcesdxcentral.com
Open sourcegouvernement.lu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed active exploitation of a zero-day command injection flaw in Huawei HG532 home routers, tracked as **CVE-2017-17215**, after detecting widespread attacks against port `37215`. The exploit was used to install **OKIRU/SATORI**, an updated **Mirai** variant that converts compromised routers into DDoS bots and communicates with its command-and-control infrastructure over a custom protocol. Researchers said the activity was observed globally, with notable concentrations in the United States, Italy, Germany, and Egypt. Huawei issued a patch after coordinated disclosure, while Check Point linked the campaign to a suspected actor using the nickname **"Nexus Zeta"** based on domain registration and online persona overlaps. The researchers assessed the operator as relatively unskilled despite leveraging a zero-day exploit, underscoring how leaked botnet code and exposed IoT devices can enable large-scale botnet recruitment and downstream denial-of-service operations.
Jul 12, 2026
A threat actor using the alias **Anarchy** reportedly assembled a botnet of roughly **18,000 compromised Huawei HG532 routers in a single day** by exploiting **`CVE-2017-17215`**, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential **DDoS** or other criminal activity. Public exploit details for **`CVE-2017-17215`** showed that attackers could send a crafted **SOAP** request to the router's **UPnP `WANPPPConnection` service on port `37215`** and inject shell commands through the `NewStatusURL` field of the `Upgrade` action, using the default credentials **`dslf-config/admin`**. Reporting also indicated that the actor planned to expand operations by targeting **`CVE-2014-8361`** in **Realtek-based routers** via **port `52869`**, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Aug 15, 2026
Attackers are actively scanning for **CVE-2023-33538**, a command injection flaw in end-of-life TP-Link routers including **TL-WR940N**, **TL-WR740N**, and **TL-WR841N**, in an apparent effort to deploy a Mirai-based Condi botnet variant. Researchers observed malicious requests targeting the `/userRpm/WlanNetworkRpm.htm` interface, abusing SSID-related parameters to fetch an ELF payload such as `arm7` from **51.38.137[.]113** and connect infected devices to infrastructure including **cnc.vietdediserver[.]shop** and **bot.ddosvps.cc**. The activity followed CISA’s addition of the flaw to its Known Exploited Vulnerabilities catalog, underscoring continued attacker interest in legacy edge devices. Palo Alto Networks Unit 42 and other researchers said the vulnerability is real, but the exploitation attempts seen so far were unsuccessful because the campaigns used flawed tradecraft: they lacked valid authentication to the router web interface, targeted incorrect parameters, and relied on tools such as `wget` that are not present in the routers’ constrained BusyBox environments. TP-Link said the affected products are no longer supported and will not receive patches, leaving replacement of the devices and elimination of default or weak administrative credentials as the primary mitigations.
Jun 29, 2026