Loading story…
A botnet campaign is scanning web-exposed router and network-device diagnostic interfaces for command-injection flaws in features such as ping, traceroute, and other troubleshooting tools. Internet Storm Center observed repeated automated requests against multiple diagnostic-related URL paths tied to known or suspected vulnerabilities, including CVE-2024-12856 in Four-Faith routers, CVE-2013-7179 in Seowon Intech WiMAX SWU-9100 devices, CVE-2020-8949 in Gocloud devices, and possibly CVE-2024-48419 in Edimax routers.
The activity indicates broad reconnaissance to identify devices where user input can be turned into shell commands, though the reporting does not confirm that every probed endpoint was vulnerable or successfully exploited. The coverage highlights why diagnostic utilities are a recurring weakness: they often pass user-supplied values into operating-system commands through unsafe string concatenation. Defenders are urged to disable remote administration where possible, limit management access to trusted networks, apply firmware updates, and replace unsupported hardware, while developers are advised to use argument-separated execution methods instead of building shell commands directly from web input.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported that a botnet campaign was actively probing router web interfaces for command-injection weaknesses in diagnostic features and summarized the Internet Storm Center findings. The article highlighted routers as attractive botnet targets because they often remain exposed and unpatched for long periods.
The SANS diary recommended separating commands from arguments using execv-style APIs, citing Python subprocess.run as a safer interface because shell metacharacters are treated as part of the argument string rather than executed. It also noted that some tools still require input validation in edge cases, such as commands with dangerous options.
In the SANS Internet Storm Center diary, Ullrich explained that diagnostic tools often invoke operating-system commands with user-supplied input and identified command concatenation as the root cause of command injection. The write-up used an unsafe os.system ping example to illustrate how mixing control data and user data creates exploitable conditions.
The observed requests were associated or tentatively associated with known vulnerabilities including CVE-2024-12856 in Four-Faith routers, CVE-2013-7179 in Seowon Intech WiMAX SWU-9100 devices, CVE-2020-8949 in Gocloud devices, and possibly CVE-2024-48419 in Edimax routers. The reporting notes that this does not prove every targeted endpoint was vulnerable or successfully exploited.
Johannes B. Ullrich reported observing repeated automated requests to web-exposed diagnostic and troubleshooting paths on network devices, including ping, traceroute, and related utilities. The probing targeted endpoints such as /apply.cgi, /cgi-bin/diagnostic.cgi, /diag_ping.cgi, /goform/diagTool, and other diagnostic URLs associated with command-injection risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively scanning for **CVE-2023-33538**, a command injection flaw in end-of-life TP-Link routers including **TL-WR940N**, **TL-WR740N**, and **TL-WR841N**, in an apparent effort to deploy a Mirai-based Condi botnet variant. Researchers observed malicious requests targeting the `/userRpm/WlanNetworkRpm.htm` interface, abusing SSID-related parameters to fetch an ELF payload such as `arm7` from **51.38.137[.]113** and connect infected devices to infrastructure including **cnc.vietdediserver[.]shop** and **bot.ddosvps.cc**. The activity followed CISA’s addition of the flaw to its Known Exploited Vulnerabilities catalog, underscoring continued attacker interest in legacy edge devices. Palo Alto Networks Unit 42 and other researchers said the vulnerability is real, but the exploitation attempts seen so far were unsuccessful because the campaigns used flawed tradecraft: they lacked valid authentication to the router web interface, targeted incorrect parameters, and relied on tools such as `wget` that are not present in the routers’ constrained BusyBox environments. TP-Link said the affected products are no longer supported and will not receive patches, leaving replacement of the devices and elimination of default or weak administrative credentials as the primary mitigations.
Jun 29, 2026
Researchers have identified a previously undocumented botnet dubbed **AryStinger** that has compromised more than 4,000 legacy routers worldwide and repurposed them as attacker-controlled proxies for reconnaissance, tunneling, traffic interception, DNS tampering, and remote command execution. QiAnXin XLab said the campaign primarily targets outdated **RTL819X-based** devices, including **D-Link DIR-850L** and **DIR-818LW** routers, and also includes a newer Go-based variant aimed at NAS devices. Infections are concentrated in **South Korea** and **China**, with additional activity observed in **Sweden, Malaysia, and Singapore**. The malware exploits long-known flaws including `CVE-2013-3307` and `CVE-2016-5681` on older Linksys and D-Link hardware, while the NAS-focused strain has been linked to `CVE-2025-11837`. XLab reported that AryStinger communicates with command-and-control servers over HTTP/HTTPS using **Protobuf** with **XOR** encryption, establishes persistence through **Dropbear** or **gs-netcat**, and appears designed less for DDoS or cryptomining than for building covert attack infrastructure. Researchers said attribution remains unclear and urged organizations and consumers to replace end-of-life routers, update firmware, change default administrator credentials, and disable remote management.
Jul 12, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026