Loading story…
A critical remote code execution flaw in Dasan GPON home routers, tracked as CVE-2018-10561, exposed more than a million internet-facing devices to takeover and was rapidly adopted by threat actors. Reporting on the vulnerability described how the bug enabled attackers to run commands on vulnerable routers, turning widely deployed consumer networking equipment into attractive targets for mass compromise.
Security researchers observed the flaw being weaponized by at least two IoT botnets, Omni and Muhstik, shortly after public disclosure. The Omni campaign reportedly used a three-stage infection chain to download, change permissions on, and execute Mirai-style payloads across multiple architectures, while Muhstik added the GPON exploit to a broader set of router and IoT attack methods. The activity underscored how quickly publicly known one-day vulnerabilities in exposed edge devices can be folded into botnet operations for large-scale abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
According to NewSky, 360 Netlab confirmed the finding that Muhstik was exploiting CVE-2018-10561. This provided external corroboration of the observed botnet activity.
NewSky Security also observed the Muhstik botnet deploying CVE-2018-10561 against its honeypots, adding the GPON flaw to a broader exploit set. The activity showed Muhstik using multiple exploits plus a new GPON infection URL.
NewSky reported infrastructure overlap between the Omni campaign and the Owari botnet, including a payload-hosting IP and the 0day.life domain. It concluded Omni was being developed in the same lab as Owari.
NewSky Security observed an Omni botnet campaign targeting vulnerable GPON routers with a three-step infection chain that downloaded, chmodded, and executed Mirai-style payloads. The researchers said the botnet appeared to be under development based on fresh payloads and communication with a person claiming to be its author.
After disclosing the flaw and before an official vendor fix was noted, VPNMentor later published its own patch for CVE-2018-10561. The NewSky report cites this as part of the vulnerability's disclosure timeline.
VPNMentor disclosed the critical remote code execution vulnerability CVE-2018-10561 affecting Dasan GPON home routers before a vendor patch was available. The disclosure said more than a million GPON devices were potentially exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **RondoDox** botnet is actively exploiting `CVE-2018-5999`, a critical remote code execution flaw in Asus routers that lets unauthenticated attackers gain **root access**. VulnCheck said it observed in-the-wild exploitation beginning on May 17, marking the first known real-world abuse of the 2018 vulnerability even though public exploit code has been available for years. The flaw affects widely deployed consumer routers, with more than 1 million Asus devices believed to be exposed online. RondoDox, a Linux-focused botnet first seen in mid-2025 and often described as a **Mirai** variant, uses multi-stage mass exploitation against end-of-life and IoT devices, frequently chaining older embedded-device CVEs before deploying malware and connecting to command-and-control infrastructure. Researchers said the botnet is primarily used for denial-of-service attacks and appears to rely on compromised residential IP addresses for hosting, suggesting its operators closely track vulnerability disclosures and rapidly weaponize older flaws in consumer networking gear.
Jun 29, 2026
A threat actor using the alias **Anarchy** reportedly assembled a botnet of roughly **18,000 compromised Huawei HG532 routers in a single day** by exploiting **`CVE-2017-17215`**, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential **DDoS** or other criminal activity. Public exploit details for **`CVE-2017-17215`** showed that attackers could send a crafted **SOAP** request to the router's **UPnP `WANPPPConnection` service on port `37215`** and inject shell commands through the `NewStatusURL` field of the `Upgrade` action, using the default credentials **`dslf-config/admin`**. Reporting also indicated that the actor planned to expand operations by targeting **`CVE-2014-8361`** in **Realtek-based routers** via **port `52869`**, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Aug 16, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026