Loading story…
Palo Alto Networks Unit 42 reported that the Muhstik botnet targeted routers running Tomato firmware to compromise internet-connected devices and expand its botnet infrastructure. The activity focused on harvesting new IoT victims through exposed or weakly secured router services, allowing the malware operators to use compromised edge devices as a foothold for broader propagation.
The campaign highlights how consumer and small-office networking equipment can be abused as an entry point for persistent botnet growth. By compromising Tomato-based routers, the operators were able to recruit additional devices into the Muhstik ecosystem, reinforcing the ongoing risk posed by poorly secured IoT and router deployments exposed to the public internet.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research describing Muhstik botnet activity abusing Tomato routers to recruit additional IoT devices. The reference indicates the campaign and its technical details were publicly disclosed at that time.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw in Dasan GPON home routers, tracked as **`CVE-2018-10561`**, exposed more than a million internet-facing devices to takeover and was rapidly adopted by threat actors. Reporting on the vulnerability described how the bug enabled attackers to run commands on vulnerable routers, turning widely deployed consumer networking equipment into attractive targets for mass compromise. Security researchers observed the flaw being weaponized by at least two IoT botnets, **Omni** and **Muhstik**, shortly after public disclosure. The Omni campaign reportedly used a three-stage infection chain to download, change permissions on, and execute Mirai-style payloads across multiple architectures, while Muhstik added the GPON exploit to a broader set of router and IoT attack methods. The activity underscored how quickly publicly known one-day vulnerabilities in exposed edge devices can be folded into botnet operations for large-scale abuse.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026
A threat actor using the alias **Anarchy** reportedly assembled a botnet of roughly **18,000 compromised Huawei HG532 routers in a single day** by exploiting **`CVE-2017-17215`**, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential **DDoS** or other criminal activity. Public exploit details for **`CVE-2017-17215`** showed that attackers could send a crafted **SOAP** request to the router's **UPnP `WANPPPConnection` service on port `37215`** and inject shell commands through the `NewStatusURL` field of the `Upgrade` action, using the default credentials **`dslf-config/admin`**. Reporting also indicated that the actor planned to expand operations by targeting **`CVE-2014-8361`** in **Realtek-based routers** via **port `52869`**, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Sep 3, 2026