Loading story…
A threat actor using the alias Anarchy reportedly assembled a botnet of roughly 18,000 compromised Huawei HG532 routers in a single day by exploiting CVE-2017-17215, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential DDoS or other criminal activity.
Public exploit details for CVE-2017-17215 showed that attackers could send a crafted SOAP request to the router's UPnP WANPPPConnection service on port 37215 and inject shell commands through the NewStatusURL field of the Upgrade action, using the default credentials dslf-config/admin. Reporting also indicated that the actor planned to expand operations by targeting CVE-2014-8361 in Realtek-based routers via port 52869, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Exploit-DB published a verified proof-of-concept for arbitrary command execution on Huawei HG532 routers, identified as CVE-2017-17215. The entry showed how a crafted SOAP request to the router's WANPPPConnection service could execute shell commands remotely.
Huawei published a security notice confirming the existence of CVE-2017-17215, a remote code execution flaw affecting HG532 devices, after receiving the report from Check Point researcher Muhammad Mukatren on November 27, 2017. The company advised mitigations, noted IPS signature updates, and said fix versions were provided for non-End of Service products.
Cymulate Threat Research Group identified a Mirai-related shell variant exploiting CVE-2017-17215 on Huawei HG532 routers. The campaign retrieved UPX-packed, multi-architecture ELF payloads from 85.217.144[.]35/condi/ and executed them on compromised devices.
According to researcher Ankit Anubhav, Anarchy said he also planned to target CVE-2014-8361 in Realtek routers, exploitable via port 52869. This marked an intended expansion beyond Huawei HG532 devices.
Threat actor 'Anarchy' reportedly assembled a botnet of about 18,000 compromised devices in a single day by exploiting Huawei HG532 routers via CVE-2017-17215. The actor also shared a list of infected victim IP addresses with researcher Ankit Anubhav, who did not publish it.
A July 19 blog post cited by later reporting noted an increase in the number of compromised Huawei routers. This indicated active exploitation of CVE-2017-17215 in the wild before broader coverage of the botnet's scale.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cymulate.com
Open sourcecve.mitre.org
Open sourcescmagazine.com
Open sourceexploit-db.com
Open sourcehuawei.com
Open sourcehuawei.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed active exploitation of a zero-day command injection flaw in Huawei HG532 home routers, tracked as **CVE-2017-17215**, after detecting widespread attacks against port `37215`. The exploit was used to install **OKIRU/SATORI**, an updated **Mirai** variant that converts compromised routers into DDoS bots and communicates with its command-and-control infrastructure over a custom protocol. Researchers said the activity was observed globally, with notable concentrations in the United States, Italy, Germany, and Egypt. Huawei issued a patch after coordinated disclosure, while Check Point linked the campaign to a suspected actor using the nickname **"Nexus Zeta"** based on domain registration and online persona overlaps. The researchers assessed the operator as relatively unskilled despite leveraging a zero-day exploit, underscoring how leaked botnet code and exposed IoT devices can enable large-scale botnet recruitment and downstream denial-of-service operations.
Jul 12, 2026
Researchers have identified a previously undocumented botnet dubbed **AryStinger** that has compromised more than 4,000 legacy routers worldwide and repurposed them as attacker-controlled proxies for reconnaissance, tunneling, traffic interception, DNS tampering, and remote command execution. QiAnXin XLab said the campaign primarily targets outdated **RTL819X-based** devices, including **D-Link DIR-850L** and **DIR-818LW** routers, and also includes a newer Go-based variant aimed at NAS devices. Infections are concentrated in **South Korea** and **China**, with additional activity observed in **Sweden, Malaysia, and Singapore**. The malware exploits long-known flaws including `CVE-2013-3307` and `CVE-2016-5681` on older Linksys and D-Link hardware, while the NAS-focused strain has been linked to `CVE-2025-11837`. XLab reported that AryStinger communicates with command-and-control servers over HTTP/HTTPS using **Protobuf** with **XOR** encryption, establishes persistence through **Dropbear** or **gs-netcat**, and appears designed less for DDoS or cryptomining than for building covert attack infrastructure. Researchers said attribution remains unclear and urged organizations and consumers to replace end-of-life routers, update firmware, change default administrator credentials, and disable remote management.
Jul 12, 2026
Attackers are actively scanning for **CVE-2023-33538**, a command injection flaw in end-of-life TP-Link routers including **TL-WR940N**, **TL-WR740N**, and **TL-WR841N**, in an apparent effort to deploy a Mirai-based Condi botnet variant. Researchers observed malicious requests targeting the `/userRpm/WlanNetworkRpm.htm` interface, abusing SSID-related parameters to fetch an ELF payload such as `arm7` from **51.38.137[.]113** and connect infected devices to infrastructure including **cnc.vietdediserver[.]shop** and **bot.ddosvps.cc**. The activity followed CISA’s addition of the flaw to its Known Exploited Vulnerabilities catalog, underscoring continued attacker interest in legacy edge devices. Palo Alto Networks Unit 42 and other researchers said the vulnerability is real, but the exploitation attempts seen so far were unsuccessful because the campaigns used flawed tradecraft: they lacked valid authentication to the router web interface, targeted incorrect parameters, and relied on tools such as `wget` that are not present in the routers’ constrained BusyBox environments. TP-Link said the affected products are no longer supported and will not receive patches, leaving replacement of the devices and elimination of default or weak administrative credentials as the primary mitigations.
Jun 29, 2026