Botnet

Hackers are actively exploiting Four-Faith industrial routers to build botnets, leveraging a critical vulnerability identified as CVE-2024-9643. Security researchers from CrowdSec report a sharp rise in exploitation attempts targeting these devices, signaling a shift from initial probing to large-scale abuse. CVE-2024-9643...

A new iteration of the notorious Mirai botnet, dubbed Nexcorium, has emerged in the wild, aggressively targeting internet-connected video recording devices. According to recent threat research published by Fortinet's FortiGuard Labs, threat actors are exploiting a known command injection...

A sophisticated attack is targeting Windows Server systems using Prometei, a Russian-linked botnet that has been active since 2016. This multi-functional malware combines cryptocurrency mining, credential theft, and remote-control capabilities to maintain long-term access to compromised systems. The Prometei botnet infiltrates...

Threat actors are allegedly offering the complete source code of a sophisticated Malware-as-a-Service (MaaS) botnet for sale.  This advanced malicious framework represents a significant escalation in cybercriminal capabilities, leveraging legitimate enterprise-grade technologies and blockchain integration to create a highly resilient...

A sophisticated botnet campaign dubbed "AyySSHush" has compromised over 9,000 ASUS routers worldwide, establishing persistent backdoor access that survives firmware updates and reboots.  The stealthy operation, first detected in March 2025, demonstrates advanced nation-state-level tradecraft by exploiting authentication vulnerabilities and...

A newly identified botnet, tracked as Eleven11bot, has compromised approximately 30,000 internet-connected devices—primarily security cameras and network video recorders (NVRs)—to launch distributed denial-of-service (DDoS) attacks against critical infrastructure.  Discovered by Nokia Deepfield’s Emergency Response Team (ERT) on February 26, 2025,...

A sophisticated botnet operation has compromised 1.6 million Android TV devices across 226 nations, leveraging advanced domain generation algorithms and cryptographic evasion techniques to create the largest known IoT threat since the 2016 Mirai attacks.  Dubbed Vo1d, this operation represents...

Juniper Networks has issued an urgent advisory following reports of Mirai malware infections targeting Session Smart Routers (SSRs) left with default passwords. The campaign, first detected on December 11, exploited weak security practices to compromise devices and use them...

The BADBOX botnet, a sophisticated cybercriminal operation, has compromised approximately 74,000 devices, including Android TV boxes, smartphones, and other electronics. This malware is pre-installed on devices before they even reach consumers, making it a particularly insidious threat. BADBOX is not just...

The Gafgyt malware (often referred to as Bashlite or Lizkebab) has expanded its attack scope by targeting publicly exposed Docker Remote API servers. Gafgyt malware, also known as Bashlite, and Mirai have targeted millions of vulnerable IoT devices in recent...