Loading story…
Attackers actively exploited a post-authentication remote code execution flaw in Symantec Secure Web Gateway 5.0.2.8, using it to compromise legacy appliances that had reached end-of-life in 2015 and end-of-support in 2019. Palo Alto Networks Unit 42 reported two separate campaigns: an evolved Hoaxcalls botnet that began exploiting the issue shortly after public disclosure, and a Mirai-based variant observed soon afterward. Symantec said the vulnerability is not present in Symantec Web Gateway 5.2.8 and does not affect ProxySG or Web Security Services.
The Hoaxcalls variant expanded beyond earlier behavior by adding traffic proxying, persistence, reboot prevention, update functions, and broader distributed denial-of-service capabilities after gaining access to vulnerable devices. The Mirai-linked activity appeared focused more on propagation than disruption, combining exploitation with credential brute force to spread to additional targets. Researchers noted that the attack surface was somewhat limited because the flaw required authentication and affected only older, 2012-era devices running the vulnerable firmware.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
A separate Mirai-based botnet campaign using the same Symantec Secure Web Gateway exploit surfaced in early May 2020. Unlike typical Mirai activity, the samples focused on propagation through brute force and exploitation rather than DDoS.
Unit 42 observed the first exploitation of the post-authentication remote code execution flaw in Symantec Secure Web Gateway 5.0.2.8 on April 24, 2020, in a Hoaxcalls campaign. The exploit targeted /spywall/timeConfig.php via a malicious ntpserver parameter to execute shell commands and deploy a payload.
The Hoaxcalls botnet was first discovered in April 2020 as an offshoot of the Bashlite/Gafgyt malware family.
The vulnerable Symantec Secure Web Gateway 5.0.2.8 firmware reached end-of-support in 2019, leaving affected legacy devices unsupported.
Symantec Secure Web Gateway 5.0.2.8, the firmware later targeted in these botnet campaigns, became end-of-life in 2015.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
New variants of the **Mirai** and **Gafgyt** IoT/Linux botnets were observed expanding from consumer devices to enterprise-facing systems by exploiting known vulnerabilities in **Apache Struts** and **SonicWall Global Management System**. Palo Alto Networks Unit 42 reported that a Mirai sample targeted `CVE-2017-5638`, the remote code execution flaw in Apache Struts tied to the Equifax breach, marking the first known case of Mirai using that exploit in the wild. A Gafgyt variant was also seen exploiting `CVE-2018-9866` in older, unsupported SonicWall GMS versions shortly after a Metasploit module for the bug became public. Researchers linked both malware families through infrastructure involving **l[.]ocalhost[.]host** and said the Mirai sample carried 16 exploits in total, while the Gafgyt sample included scanning and DDoS capabilities such as **Blacknurse**, underscoring a broader shift by IoT/Linux botnets toward outdated enterprise targets.
Aug 14, 2026
Attackers were observed exploiting **`CVE-2020-9020`**, a critical remote command execution flaw in **Iteris Vantage Velocity** field units, to deploy a **Satori** variant of the **Mirai** botnet. The activity targeted versions **2.3.1, 2.4.2, and 3.0** through crafted HTTP requests to the vulnerable **`/cgi-bin/timeconfig.py`** endpoint, injecting commands via the **`htmlNtpServer`** parameter and downloading malware from **`198.23.238.203`**. The malware was built to compromise multiple CPU architectures and then scan random hosts over **Telnet port 23** using an embedded password dictionary, behavior consistent with Mirai-style propagation. Researchers said infected traffic-monitoring devices could be repurposed for **botnet enrollment, DDoS operations, or data leakage**, and noted communications with a suspected command-and-control service over **SSL on port 5684**; affected organizations were urged to patch or upgrade exposed systems.
Aug 14, 2026