Loading story…
Palo Alto Networks Unit 42 reported that attackers exploited vulnerable home and small office wireless routers and used the compromised devices as infrastructure to target gaming servers. The activity turned consumer and small-business networking equipment into a distributed attack platform, allowing malicious traffic to be routed through legitimate internet connections and making the attacks harder to trace directly to the operators.
The report highlights how poorly secured edge devices can be repurposed beyond simple botnet activity and used to disrupt online gaming environments. For defenders, the incident underscores the need to patch router firmware, disable exposed remote administration features, replace default credentials, and monitor for unusual outbound traffic from SOHO networking equipment that may indicate compromise.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research describing how home and small office wireless routers were being exploited to attack gaming servers. The reference provides no additional dated milestones, so the publication itself is the only distinct event supported by the content provided.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A botnet campaign is scanning web-exposed router and network-device diagnostic interfaces for command-injection flaws in features such as **ping**, **traceroute**, and other troubleshooting tools. Internet Storm Center observed repeated automated requests against multiple diagnostic-related URL paths tied to known or suspected vulnerabilities, including `CVE-2024-12856` in Four-Faith routers, `CVE-2013-7179` in Seowon Intech WiMAX `SWU-9100` devices, `CVE-2020-8949` in Gocloud devices, and possibly `CVE-2024-48419` in Edimax routers. The activity indicates broad reconnaissance to identify devices where user input can be turned into shell commands, though the reporting does not confirm that every probed endpoint was vulnerable or successfully exploited. The coverage highlights why diagnostic utilities are a recurring weakness: they often pass user-supplied values into operating-system commands through unsafe string concatenation. Defenders are urged to disable remote administration where possible, limit management access to trusted networks, apply firmware updates, and replace unsupported hardware, while developers are advised to use argument-separated execution methods instead of building shell commands directly from web input.
Aug 5, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026
A **GRU-linked espionage campaign** attributed to **Forest Blizzard** is targeting small office and home office (SOHO) routers by changing DNS settings on poorly protected devices. The altered DNS redirects users trying to reach legitimate services to adversary-in-the-middle infrastructure, where victims are presented with fake login pages that capture **credentials** and **session tokens** before silently forwarding them to the real destination. The activity poses a particular risk to **remote workers** because it abuses unmanaged home-network infrastructure rather than compromising corporate endpoints directly, allowing attackers to intercept identity and business traffic from outside traditional enterprise defenses. Reported mitigations include enforcing **MFA**, routing traffic through **VPNs**, using centralized and monitored DNS, applying traffic filtering, and improving hardening, management, and monitoring of routers and other edge devices.
Jul 16, 2026