Loading story…
A Mirai variant rapidly spread by targeting ZyXEL PK5001Z routers affected by CVE-2016-10401, a backdoor account flaw that exposed hardcoded Telnet credentials and a hidden path to root access. After proof-of-concept exploit code was published, attackers began scanning ports 23 and 2323 at scale, logging in with credentials including admin/CenturyL1nk and admin/QwestM0dem, then using the device's built-in super-user capability to install Mirai malware on vulnerable internet-exposed routers.
Researchers reported nearly 100,000 unique scanning IPs over roughly 60 hours, with a large share of activity traced to Argentina, particularly networks associated with Telefonica de Argentina. Netlab linked the campaign to command-and-control servers at bigboatreps.pw:23 and blacklister.nl:23, and said the malware was distributed in multiple CPU-specific builds before both servers were later sinkholed by the security community. The vulnerable modem version cited in public exploit material was PK5001Z 2.6.20.19, a model used by CenturyLink.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Netlab reported nearly 100,000 unique scanner IPs over roughly 60 hours, with a heavy concentration in Argentina, and tied the outbreak to Telnet scanning on ports 23 and 2323. The report also disclosed command-and-control servers, malware hashes, and download URLs for multiple Mirai binaries.
Netlab reported that abuse of the admin/CenturyL1nk and admin/QwestM0dem credentials peaked during daytime on 2017-11-23. The timing and IP overlap supported the assessment that this credential abuse drove the broader scanning surge.
Researchers observed a new Mirai variant begin spreading around 2017-11-22 11:00 by scanning Telnet ports 23 and 2323 and abusing the credentials admin/CenturyL1nk and admin/QwestM0dem. The activity was linked to exploitation of exposed ZyXEL PK5001Z routers.
Exploit-DB published EDB-ID 43105 for CVE-2016-10401, documenting hardcoded Telnet credentials and a hardcoded root password in ZyXEL PK5001Z modems. The proof of concept showed remote Telnet access followed by privilege escalation to root.
An update to the Netlab report stated that both identified command-and-control servers, bigboatreps.pw:23 and blacklister.nl:23, had been sinkholed by the security community.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceblog.netlab.360.com
Open sourceexploit-db.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and defenders warned that two critical zero-day vulnerabilities in Zyxel CPE devices, `CVE-2024-40890` and `CVE-2024-40891`, are being actively exploited in the wild. The flaws affect Zyxel CPE models that are now end-of-life and can enable command injection leading to full device compromise; reporting from GreyNoise highlighted active exploitation of `CVE-2024-40891`, while CSIRT.SK said Mirai-based botnet variants have been observed abusing the issue. The exposed devices appear to be attractive initial-access targets because they sit at the network edge and can be conscripted into botnets or used as footholds into victim environments. Zyxel is not expected to issue patches for the affected hardware, leaving organizations to mitigate by replacing vulnerable devices, restricting access to administrative interfaces, and increasing monitoring of HTTP and Telnet traffic for signs of exploitation and post-compromise activity.
Jul 24, 2026
Zyxel warned that **CVE-2020-9054** is a critical pre-authentication remote code execution flaw in the `weblogin.cgi` component of certain NAS and firewall products, caused by missing authentication that enables OS command injection. The company said affected systems include NAS devices running firmware **5.21 and earlier** and several UTM, ATP, and VPN firewall releases on **ZLD V4.35 Patch 0 through Patch 2**, and urged customers to install firmware updates immediately or apply workarounds for unsupported devices. Zyxel later reiterated the risk after noting that BotenaGo malware was targeting devices with known CVEs, advising organizations to patch or isolate internet-exposed systems. Palo Alto Networks' Unit 42 reported that a public proof of concept for **CVE-2020-9054** was quickly weaponized to compromise vulnerable Zyxel NAS devices and install a Mirai variant dubbed **Mukashi**. Researchers observed exploitation in the wild beginning March 12, 2020, with attackers using a shell script to fetch architecture-specific bot binaries, erase traces, and enroll devices into a botnet that scans TCP port **23**, brute-forces default credentials, and supports multiple DDoS commands. Unit 42 said the malware communicated with **45[.]84[.]196[.]75** over TCP ports **34834** and **4864**, while also binding locally to TCP port **23448** to prevent multiple infections on the same host.
Aug 15, 2026
A renewed **Mirai** botnet campaign is targeting internet-exposed routers and IoT devices by exploiting known vulnerabilities, with advisories highlighting compromises affecting industrial routers, smart home systems, DVRs, cameras, and 5G/LTE equipment. Reported targets include devices from **ASUS, Huawei, Neterbit, LB-Link, Four-Faith, Kguard, Lilin,** and **Vimar**, as well as generic DVR platforms and PZT cameras, indicating broad opportunistic scanning of exposed edge infrastructure. National CERT advisories from Brunei and Colombia warned that Mirai-related botnet activity continues to threaten consumer and industrial environments, including routers and other connected devices. Defenders were urged to **patch exposed systems**, **disable remote access where possible**, **replace default credentials with strong unique passwords**, and **scan networks for vulnerable or internet-facing assets** to reduce the risk of botnet enrollment and downstream abuse such as distributed denial-of-service activity.
Aug 1, 2026