Loading story…
The TheMoon malware spread across multiple Linksys router models by exploiting an unauthenticated remote code execution flaw exposed through the HNAP interface and CGI endpoints including tmUnblock.cgi and hndUnblock.cgi on port 8080. Researchers reported that the worm queried /HNAP1/ to identify device model and firmware, then triggered command injection to launch a shell script that fetched a roughly 2 MB MIPS ELF payload. Public exploit code later showed how the flaw could write a payload to /tmp/c0d3z, mark it executable, and run it to open a bind shell on TCP port 4444, confirming the practicality of the attack path used against vulnerable routers.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Fortinet reported active detection of exploitation of CVE-2014-9583 against ASUS routers since June of that year, used to deploy a TheMoon-family bot. The infection chain downloaded nmlt1.sh and then a MIPS binary named .nttpd from 78.128.92.137.
Johannes Ullrich discovered TheMoon worm activity in the wild affecting Linksys routers. The worm abused an unauthenticated vulnerability exposed via port 8080 and vulnerable CGI functionality to spread.
Fortinet analyzed a TheMoon-family bot that used modules named clk, net, and dwl, communicated with peers over UDP port 5143, and fetched additional payloads over TCP port 4543. The analysis also found iptables rules intended to block competing exploitation attempts against both ASUS CVE-2014-9583 and a Linksys remote code execution vulnerability.
A public proof-of-concept exploit for the Linksys unauthenticated remote code execution vulnerability was published by Rew. The exploit targeted tmUnblock.cgi and hndUnblock.cgi via the ttcp_ip parameter and wrote a MIPS payload that opened a bind shell on TCP port 4444.
Researchers reported that TheMoon was spreading across multiple Linksys router models by querying /HNAP1/ on port 8080, exploiting a vulnerable CGI script without valid authentication, and downloading a roughly 2 MB ELF MIPS payload. They also published indicators including heavy outbound scanning on ports 80 and 8080 and inbound attempts to miscellaneous ports below 1024.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourceexploit-db.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch incident responders found the **Alogin** and **TheMoon** malware families concurrently operating on an internet-exposed ASUS RT-AC66U consumer router. Alogin installed a malicious Telnet login handler and a Microsocks SOCKS5 proxy, while a newer TheMoon variant established persistence through loaders and proxy components stored in the router’s writable JFFS partition. The Netherlands’ NCSC identified about 150 likely compromised SOHO routers domestically and assessed the wider network at roughly 13,000 systems worldwide. Observed activity included low-volume authentication attempts against Microsoft cloud services and SSH brute-force attempts, consistent with the routers being used as intermediary infrastructure. ASUS issued firmware updates for supported affected models; organizations and consumers should patch exposed routers, replace unsupported hardware, and disable unnecessary remote-access services.
Aug 31, 2026
Attackers are actively scanning for **CVE-2023-33538**, a command injection flaw in end-of-life TP-Link routers including **TL-WR940N**, **TL-WR740N**, and **TL-WR841N**, in an apparent effort to deploy a Mirai-based Condi botnet variant. Researchers observed malicious requests targeting the `/userRpm/WlanNetworkRpm.htm` interface, abusing SSID-related parameters to fetch an ELF payload such as `arm7` from **51.38.137[.]113** and connect infected devices to infrastructure including **cnc.vietdediserver[.]shop** and **bot.ddosvps.cc**. The activity followed CISA’s addition of the flaw to its Known Exploited Vulnerabilities catalog, underscoring continued attacker interest in legacy edge devices. Palo Alto Networks Unit 42 and other researchers said the vulnerability is real, but the exploitation attempts seen so far were unsuccessful because the campaigns used flawed tradecraft: they lacked valid authentication to the router web interface, targeted incorrect parameters, and relied on tools such as `wget` that are not present in the routers’ constrained BusyBox environments. TP-Link said the affected products are no longer supported and will not receive patches, leaving replacement of the devices and elimination of default or weak administrative credentials as the primary mitigations.
Jun 29, 2026
A threat actor using the alias **Anarchy** reportedly assembled a botnet of roughly **18,000 compromised Huawei HG532 routers in a single day** by exploiting **`CVE-2017-17215`**, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential **DDoS** or other criminal activity. Public exploit details for **`CVE-2017-17215`** showed that attackers could send a crafted **SOAP** request to the router's **UPnP `WANPPPConnection` service on port `37215`** and inject shell commands through the `NewStatusURL` field of the `Upgrade` action, using the default credentials **`dslf-config/admin`**. Reporting also indicated that the actor planned to expand operations by targeting **`CVE-2014-8361`** in **Realtek-based routers** via **port `52869`**, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Sep 3, 2026