draytek

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.

DrayTek heeft meerdere kwetsbaarheden verholpen in de VigorSwitch productlijn. De kwetsbaarheden betreffen voornamelijk command injection, buffer overflow, null pointer dereference, directory traversal en onvoldoende autorisatiecontroles in diverse functies van de DrayTek VigorSwitch apparaten. Command injection kwetsbaarheden bevinden zich onder andere in functies zoals jsonstatus, commandTable, pingtrace, webBackupAction, sysreboot, auth_set, getVid, getDetail, setDevice, rebDevice, fdftDevice, setDevProto, setTime, tftp_upgrade en setDevNet. Deze maken het mogelijk voor een aanvaller om willekeurige commando's met root privileges uit te voeren. Sommige command injection kwetsbaarheden zijn pre-authenticatie, zoals in de setget.cgi interface, waardoor geen voorafgaande authenticatie vereist is voor exploitatie. Buffer overflow kwetsbaarheden zijn aanwezig in functies zoals pingtrace, webBackupAction, sysreboot, poe_schedule_profile, switch_lan_gvrp, acl_general_setup Add ACE en Edit ACE, diag_logmail en mail_mailalert. Deze kunnen leiden tot denial of service of uitvoering van willekeurige code onder administratieve rechten. Null pointer dereference kwetsbaarheden in formlogout en setget.cgi kunnen leiden tot een denial of service door het crashen van de service. Directory traversal in getSyslogFile maakt het mogelijk om, mits geauthenticeerd, toegang te krijgen tot willekeurige bestanden op het systeem. Onvoldoende autorisatiecontroles in syslog functies stellen een aanvaller in staat om configuraties te wijzigen, services te herstarten, configuraties op te slaan of logs te wissen zonder de juiste rechten. Exploitatie van deze kwetsbaarheden vereist in de meeste gevallen geldige administratieve credentials, behalve bij de pre-authenticatie command injection en null pointer dereference in setget.cgi.

DrayTek heeft meerdere kwetsbaarheden verholpen in de VigorAP productlijn. De kwetsbaarheden bevinden zich in verschillende functies en componenten van de DrayTek VigorAP apparaten, waaronder tr069TestInform, ExportSettings, setLan, setcamset, mesh_start_speed_test, InquierTime, apautotest, upload_settings.cgi en dray_apm. Deze kwetsbaarheden maken het mogelijk voor aanvallers met geldige authenticatie om via onvoldoende inputvalidatie en filtering willekeurige commando's uit te voeren met root-privileges. Daarnaast is er sprake van buffer overflow kwetsbaarheden in de setLan en apautotest functies, waarbij door het versturen van speciaal vervaardigde input een denial of service kan worden veroorzaakt of willekeurige code kan worden uitgevoerd. Exploitatie van deze kwetsbaarheden kan leiden tot volledige systeemcompromittering binnen de context van de root gebruiker. De kwetsbaarheden zijn specifiek van toepassing op meerdere modellen binnen de DrayTek VigorAP productlijn.

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the ‘jackskid’ and ‘fbot' malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism. Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm. The researchers first spotted Dysphoria on March 25 and identified multiple iterations that added meaningful updates, such as a C2 acquisition algorithm, multi-chain support, new domains, and functional separation between the relaying and DDoS variants. “Since the first quarter of 2026, XLAB has continuously tracked an emerging botnet family named Dysphoria, whose bot count exceeds 200,000,” reads XLab's report. “In just a few months, the family has undergone frequent variant updates and technical iterations, demonstrating extremely strong resilience.” The use of blockchain in C2 operations makes the overall infrastructure harder to trace and dismantle. Based on the researchers' analysis, infected clients send a fixed 78-byte login and heartbeat packet back to the C2 and receive from the operator DDoS attack commands that include duration, type, targets, and configurable flags. In late June, XLab observed a variant that focused only on transforming infected devices into network proxies, and completely discarded the DDoS functionality. The malware abuses UPnP (Universal Plug and Play) on the compromised device to create 155 port forwarding rules to expose internal services to inbound internet connections. XLab's report notes that the botnet spreads through weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and various IoT devices. Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys). However, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek). XLab monitored the botnet between July 14 and 20 and recorded a peak of 740,000 daily pings from infected hosts, 239,000 connections from overseas clients, and 1,800 from China. The researchers confidently estimate that the number of infected devices is around 200,000 at this time. Concerning the botnet’s firepower, its operators claim a maximum DDoS capacity of 4 Tbps on their clearnet site, which promotes the service as a legitimate stress-tester. Despite being significantly lower than the current record figure of 31.4 Tbps achieved by the Aisuru/Kimwolf botnet in December 2025, it is still enough to cause notable disruptions. Users can protect against botnet infections by keeping their devices’ firmware up to date, changing the default administrator password, disabling remote access if not necessary, and strengthening the security settings where available/possible. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have warned of a "resurgence and expansion" of JDY, a covert network associated with China-nexus state-sponsored threat actors. "The JDY botnet comprises over 1,500 SOHO [small office and home office] and IoT devices and operates as a centrally controlled, high-performance scanner used to discover, fingerprint, and continuously map exposed services at scale," Lumen's Black Lotus Labs said in a report shared with The Hacker News. JDY was first flagged as a cluster within another botnet codenamed KV-botnet in mid-December 2023. Primarily used for broader scanning against internet targets, the stealthy network comprising compromised SOHO routers, firewalls, and IoT devices has been put to use by Chinese hacking groups like Volt Typhoon. Following KV-botnet's takedown by the U.S. government in early 2024, the botnet operators began making behavioral changes to the network, with the second KV cluster largely going offline. It's suspected that the botnet is offered by the operators to various hacking outfits, while carrying out reconnaissance and targeting on their own. The latest findings from Black Lotus Labs show that the malware has expanded in scope to infect a broader range of devices and act as a conduit to feed "structured reconnaissance data" into a larger scanning ecosystem for follow-on target identification and exploitation. Specifically, the JDY cluster is being used to conduct targeted scanning and service fingerprinting with an aim to flag vulnerable infrastructure following public disclosures. This points to an industrialized reconnaissance effort, the results of which are leveraged by Chinese nation-state groups. This has been complemented by a growth in the botnet's size, which has surged from 650 bots at the start of January 2024 to more than 1,500 compromised devices. Most of the hacked nodes are located in the U.S. and Brazil, followed by Europe and Asia. Black Lotus Labs told The Hacker News that the cluster in Brazil is reflective of the fact that "we're seeing more and more botnets made up of Brazilian victims these days." Where previously the cluster primarily featured Cisco RV320 and RV325 routers, the present makeup of the botnet is a lot more diverse, including devices from Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys. The vast majority of the victim devices are assessed to have reached end-of-life (EoL) with known vulnerabilities. Although the exact nature of the security flaws remains unclear, it's suspected to involve the following based on the specific device models that are being exploited - Cisco RV042 - Possibly vulnerable to flaws like CVE-2023-20118 DrayTek Vigor3900 Series - Possibly vulnerable to flaws like CVE-2022-32548 Araknis AN-300-RT-4L2W - Possibly vulnerable to flaws like CVE-2023-24738 Hikvision IP cameras - Possibly vulnerable to flaws like CVE-2021-36260 Linksys LRT224 - No known CVEs, but alleged zero-days have been sold on the dark web "The botnet's large number of U.S.-based SOHO/IoT devices enables the botnet operators to evade defenses and traditional IP-based controls, such as geofencing, IP reputation-based detection, and static blocklists," Black Lotus Labs said. "By distributing their scanning and reconnaissance activity across a wide range of IP addresses, the operators make it less likely that any single IP will be labeled as a scanner and blocked. Additionally, using compromised SOHO and IoT devices helps this activity blend in with legitimate user traffic." The architecture that powers the botnet is best described as layered: the operators use Tor nodes to manage infected infrastructure, including both the command-and-control (C2) and payload servers. The C2 servers direct the bots to perform targeted reconnaissance and system profiling, as opposed to indiscriminate scanning. Results of the scans are sent to central servers for ongoing intelligence gathering in an effort to further Chinese threat actors' objectives. Attack chains weaponize newly disclosed vulnerabilities in edge devices (e.g., CVE-2026-35616) to deliver a shell script dropper that checks if the malware is already active, and if not, proceeds to download the primary payload based on the detected processor architecture (e.g., mips, mips64, mipsel, or mipsel64). Once the malware is launched, it's deleted from disk. The malware that facilitates scanning and target reconnaissance is designed to fingerprint the host, receive scanning tasks from a central C2 server, carry out high-volume TCP, SSL, UDP, and ICMP-assisted probing, capture responses (TLS certificates, metadata, etc.), and report the results back to the dispatch server. The goal is to conduct infrastructure reconnaissance rather than exploitation. A noteworthy functionality of the malware is its ability to adapt its scanning methodology based on its privileges on the local system. If it can open a raw socket, an indication of root privileges, it initiates high-speed SYN scanning using custom-crafted TCP packets. If raw sockets are unavailable or if the task is a web scan, the scanning engine resorts to using standard TCP and TLS connections or employs protocols like UDP and ICMP. This activity most likely informs asset discovery, vulnerability-targeting pipelines, and downstream exploitation or attack-orchestration systems, the cybersecurity company said. "JDY demonstrates how IoT/SOHO botnets and covert networks of compromised devices are being used for rapid vulnerability exploitation," the company said. "JDY's growth and continued operation illustrate how modern reconnaissance networks persist despite takedowns and adapt as a durable capability within a broader adversary ecosystem." "JDY's evolution from a supporting component of the KV-botnet to an independent, high-performance reconnaissance capability demonstrates that disruption of individual nodes or clusters does not eliminate the underlying capability. The capability persists, adapts, and continues to provide adversaries with timely targeting data, often within hours of vulnerability disclosure." (The story was updated after publication to include additional insights from Lumen Black Lotus Labs.)

The JDY botnet, a malware network previously associated with Chinese threat actors like Volt Typhoon, has significantly expanded its targeting scope and reconnaissance efforts. According to researchers at Black Lotus Labs by Lumen, who have been monitoring its activity, JDY maintains a strong focus on the United States, where many of its compromised devices are located and where it heavily targets military and associated networks. The security firm notes that JDY has grown from roughly 650 active bots in January 2024 to over 1,500 compromised SOHO and IoT devices today. While the numbers seem low, it's important to note that JDY isn't an exploitation framework or a DDoS botnet that requires large swarms to accumulate firepower, but is instead a distributed scanning and fingerprinting network that helps its operators locate targets vulnerable to newly disclosed flaws. "Analysis of this activity shows a clear focus on identifying vulnerable infrastructure shortly after public vulnerability disclosures, suggesting that reconnaissance output is rapidly operationalized by China-nexus advanced persistent threat (APT) actors," reads the Black Lotus Labs report. "This targeted focus has been observed across a range of sectors, with the U.S. military and associated entities as the most prominent." CISA has previously warned about the risk Volt Typhoon operatives pose to unprotected SOHO routers, urging network device vendors to eliminate vulnerabilities in SOHO router web management interfaces (WMIs) during the design and development phases. The JDY botnet is designed to conduct service discovery, service banner grabbing, TLS certificate collection, protocol fingerprinting, and flaw-focused reconnaissance. Among the compromised devices are those from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys, for MIPS, MIPS64, MIPSEL, and MIPSEL64 architectures. The threat actors are quick to target newly disclosed vulnerabilities, with Lumen researchers observing JDY scans targeting CVE-2026-35616 shortly after Fortinet publicly disclosed the FortiClient EMS flaw. The operators control the botnet through hidden Tor services, which also serve as command-and-control (C2) infrastructure. The open-source reverse-shell and host-management framework Platypus is also used in some cases. The malware registers with a central "Dispatch Service" and receives scanning assignments, which it executes, compresses the results, and sends them back to the C2. The scanning module supports the following: TCP scanning SSL/TLS scanning UDP scanning ICMP probing Banner collection TLS certificate harvesting Service fingerprinting using downloadable rule sets The botnet client repeats the same cycle until the operator specifically orders it to stop. The TCP scanning function is one of the most technically interesting, say the researchers, explaining that, when JDY has sufficient privileges, it performs much faster and stealthier raw SYN scanning. "If the malware can open a raw socket, which generally requires root or administrative privileges, it initiates high-speed SYN scanning using custom-crafted TCP packets," explains the report. "These custom packets use a fixed source port of 19000, increment the destination ports one at a time, and batch-process thousands of scan targets." As JDY botnet activity increases, organizations should ensure routers, firewalls, and IoT devices are running the latest security updates and patches to prevent them from being recruited into reconnaissance networks. Defenders should also reduce their external attack surface by disabling unnecessary internet-exposed administrative interfaces, restricting remote management access, replacing default credentials, and monitoring for unusual outbound scanning activity originating from edge devices. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A vulnerability that can be exploited to disrupt networks has been found in a Broadcom Wi-Fi chipset by researchers at application security company Black Duck. The researchers discovered the security hole while testing an Asus router, but further analysis conducted in collaboration with the vendor revealed that the issue actually existed in Broadcom chipset software used by the router. The vulnerability could pose a significant threat as it can be exploited by an unauthenticated attacker to disrupt network connectivity in organizations that use always-on wireless access. Specifically, an attacker can use a single specially crafted Wi-Fi frame to disable a router’s 5 GHz network, and disconnect active clients and prevent them from reconnecting. The attack bypasses WPA2 and WPA3 protections, and it can be repeated indefinitely to cause prolonged network disruptions. However, the cybersecurity firm pointed out that Ethernet connections and the 2.4 GHz network are not affected by the attack. Broadcom has been notified, and it told Black Duck that it has provided a patch to device manufacturers that use its chipset. Asus has released firmware updates for its affected products, but it’s unclear which other vendors use the impacted chipset. Black Duck noted that the affected Broadcom chipset is widely used in enterprise, consumer, and embedded routers. The security firm has not made public any technical details to prevent malicious exploitation of the vulnerability. “This [attack] has the potential to open the door to evil twin attacks where the real access point is knocked offline and a rogue one with the same name and password replaces it,” warned James Maude, Field CTO at BeyondTrust. “While the risks of network traffic interception have decreased thanks to the widespread adoption of HTTPS encryption, there is still the risk of captive portals. When the user tries to restore their network connection they are presented with a captive phishing portal requesting their personal or corporate credentials leading to identity compromise,” Maude explained. Randolph Barr, CISO at Cequence Security, described a few possible attack scenarios involving this vulnerability. “Based on what I’ve seen, problems like this don’t usually stay limited to ‘IT issues’. Most offices today use wireless connections more than traditional ones,” Barr said. “Imagine being on a Zoom escalation call with a customer and the network goes down.” “Even worse, imagine a board meeting where the CEO is discussing financial results, strategy, or an acquisition update, and the connection drops in the middle of the presentation. These times aren’t simply annoying; they can hurt your credibility, slow down decision-making, and make consumers, partners, and executives lose trust in you,” he added. Related: Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’ Related: Cisco Routers Hacked for Rootkit Deployment Related: Unauthenticated RCE Flaw Patched in DrayTek Routers

A security defect in the discontinued Totolink EX200 wireless range extender could allow attackers to take over vulnerable devices, the CERT Coordination Center (CERT/CC) warns. Tracked as CVE-2025-65606, the vulnerability impacts the firmware-upload error-handling logic of the network extender. When processing malformed firmware files, the firmware-upload handler enters an abnormal error state, which results in the launch of a Telnet service. The service runs with root privileges and does not require authentication, thus providing full system access, CERT/CC notes. “Because the telnet interface is normally disabled and not intended to be exposed, this behavior creates an unintended remote administration interface,” CERT/CC’s advisory reads. Successful exploitation of the vulnerability, however, requires authenticated access to the device’s web management interface, to trigger the error in the firmware-upload functionality. “Once the error condition is triggered, the resulting unauthenticated telnet service provides full control of the device,” CERT/CC says. An attacker able to trigger the bug gains complete control of the device, which allows them to modify configurations and execute arbitrary commands to infiltrate the local network. The vulnerable Totolink EX200 extender is no longer maintained, with the last firmware updates released in 2021 and 2023 (for hardware revision 1 and 2, respectively). No patch is available for the newly disclosed security defect, which was reported by Leandro Kogan. “Users should restrict administrative access to trusted networks, prevent untrusted users from accessing the management interface, monitor for unexpected telnet activity, and plan to replace the vulnerable device,” CERT/CC notes. Related: Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’ Related: Cisco Routers Hacked for Rootkit Deployment Related: Unauthenticated RCE Flaw Patched in DrayTek Routers Related: Totolink Routers, Other Device Exploits Added to Beastmode Botnet

Threat actors started exploiting a critical XWiki vulnerability en masse within two weeks of the bug being reported as exploited in the wild, VulnCheck warns. Tracked as CVE-2025-24893 (CVSS score of 9.8), the flaw was discovered in May 2024 and patched in June 2024, but a CVE identifier was assigned to it only in early 2025, after technical information became public. The bug exists because, in XWiki versions before 15.10.11, 16.4.1 and 16.5.0RC1, user-supplied input to a search function is improperly sanitized, allowing remote, unauthenticated attackers to execute arbitrary code via crafted requests to the search endpoint. Proof-of-concept (PoC) code targeting the issue has been publicly available since early 2025, and security researchers observed the defect being targeted in reconnaissance attempts, but in-the-wild exploitation started only last month. In late October, VulnCheck warned that a threat actor was exploiting CVE-2025-24893 as part of a cryptocurrency mining operation, and the US cybersecurity agency CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog two days later. Now, VulnCheck says the activity targeting vulnerable XWiki servers has expanded significantly, with multiple threat actors exploiting the bug in their attacks. The RondoDox botnet has added an exploit for the CVE to its toolset and, starting November 3, it has increasingly targeted the flaw in attacks. Since November 7, the flaw has been exploited in a second crypto-mining operation, while the threat actor behind the first mining operation expanded its activity with two new payload hosting servers and a new server hosting the exploit. VulnCheck also observed attacks in which an IP address associated with AWS, with no history of abuse, was used “to establish a reverse shell back to itself using the BusyBox nc binary”, likely as part of a targeted attack. Other threat actors also attempted to establish web shells on vulnerable XWiki servers. One of the attacks originated from an IP that “exposes both QNAP and DrayTek interfaces to the internet”, likely because it is a compromised host, and attempted to deploy a bash reverse shell. Additionally, VulnCheck has observed numerous threat actors simply performing scans and probes of vulnerable servers, including some using Nuclei templates. “Within days of the initial exploitation, we saw botnets, miners, and opportunistic scanners all adopting the same vulnerability. Once again, this highlights the gap between exploitation in the wild and visibility at scale,” VulnCheck notes. Related: Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability Related: Chrome Zero-Day Exploitation Linked to Hacking Team Spyware Related: Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk Related: CISA Confirms Exploitation of Latest Oracle EBS Vulnerability

TP-Link is warning users that some of its Omada gateways are affected by several vulnerabilities, including critical flaws. The networking giant has published two advisories this week to inform customers about four security holes in Omada gateway devices. More than a dozen ER, G and FR series product models are affected and TP-Link has released firmware patches for each of them. The most serious of the vulnerabilities appears to be CVE-2025-6542. It has a CVSS score of 9.3 and it can allow a remote, unauthenticated attacker to execute arbitrary OS commands on the targeted system. While it has not been confirmed by the vendor, these types of vulnerabilities can typically allow an attacker to take full control of impacted devices. Another flaw with a ‘critical severity’ rating is CVE-2025-7850, described as a command injection issue that can be exploited by an attacker who has admin access to the web portal of Omada gateways. The two remaining vulnerabilities have been rated ‘high severity’. CVE-2025-7851 allows an attacker to obtain root access to a device, while CVE-2025-6541 can be exploited for OS command execution by an authenticated attacker. The vendor has advised customers to not only update the firmware on their device, but also to change its password. It’s not uncommon for threat actors to exploit TP-Link product vulnerabilities in their attacks. UPDATE: Forescout, whose researchers discovered CVE-2025-7850 and CVE-2025-7851, has published a blog post detailing these flaws. Related: US Lawmakers Want Investigation Into TP-Link Over Chinese Hacking Fears Related: Cisco Routers Hacked for Rootkit Deployment Related: Unauthenticated RCE Flaw Patched in DrayTek Routers

Juniper Networks has announced patches for nearly 220 vulnerabilities in Junos OS, Junos Space, and Security Director, including nine critical-severity flaws affecting Junos Space. More than 200 security defects were resolved in Junos Space and Junos Space Security Director, Juniper’s October 2025 security advisories, published as part of the company’s predefined quarterly schedule, reveal. Junos Space version 24.1R4 was rolled out with fixes for 24 cross-site scripting (XSS) issues, including a critical-severity bug (CVE-2025-59978, CVSS score of 9.0) that could allow attackers to store script tags in text pages and execute commands on a visitor’s system with administrative privileges. Junos Space 24.1R4 Patch V1 was released with fixes for 162 unique CVEs, including nine critical-severity flaws: CVE-2019-12900, CVE-2023-38408, CVE-2024-3596, CVE-2024-27280, CVE-2024-35845, CVE-2024-47538, CVE-2024-47607, and CVE-2024-47615. Juniper also resolved a high-severity denial-of-service (DoS) vulnerability and medium-severity arbitrary file download and HTTP parameter pollution bugs in Junos Space. Additionally, the company announced fixes for three high-severity and 15 medium-severity Junos Space Security Director flaws, and for a high-severity bug in Security Director Policy Enforcer. Junos OS and Junos OS Evolved updates resolved two high-severity DoS security defects, as well as medium-severity issues that could allow attackers to access sensitive information, obtain read-write access to files, cause DoS conditions, elevate privileges and/or execute unauthorized commands, create a backdoor, or bypass a required password change. Juniper says it is not aware of any of these vulnerabilities being exploited in the wild, but users are advised to apply the patches as soon as possible, as there are no workarounds for most of these issues. Additional information on the resolved vulnerabilities can be found on Juniper’s support portal. Related: Vulnerabilities Patched by Juniper, VMware and Zoom Related: Juniper Networks Patches Dozens of Junos Vulnerabilities Related: Unauthenticated RCE Flaw Patched in DrayTek Routers Related: Critical Vulnerability Puts 60,000 Redis Servers at Risk of Exploitation

A critical-severity vulnerability that lingered in Redis for 13 years potentially exposes 60,000 servers to exploitation, cybersecurity firm Wiz warns. Redis is an open source platform that stores data in memory, mainly used as an application cache or quick-response database, as it offers increased speeds and performance. By default, the official Redis container does not require authentication, as instances should be deployed internally and not internet-accessible, but there are roughly 330,000 Redis servers exposed to the web, and 60,000 of them have no authentication. “The combination of no authentication and exposure to the internet is highly dangerous, allowing anyone to query the Redis instance and, specifically, send Lua scripts (which are enabled by default),” Wiz notes. This exposes the servers to the exploitation of the newly discovered CVE-2025-49844 (CVSS score of 10/10), named RediShell, a use-after-free issue that may allow authenticated attackers to execute arbitrary code remotely. Underlining that roughly 75% of cloud environments rely on Redis, Wiz explains that an attacker could fully compromise a system by sending a malicious Lua script to trigger the bug and escape the Lua sandbox to achieve code execution. The script would also deploy a reverse shell to establish persistent access, allowing attackers to harvest credentials and other sensitive information, exfiltrate data, install malware, move laterally using the stolen sensitive data, and escalate their privileges. “More Redis instances are exposed to internal networks where authentication may not be prioritized, allowing any host in the local network to connect to the database server. An attacker with a foothold in the cloud environment could gain access to sensitive data and exploit the vulnerability to run arbitrary code for lateral movement into sensitive networks,” Wiz notes. On October 3, Redis versions 7.22.2-12, 7.8.6-207, 7.4.6-272, 7.2.4-138, and 6.4.2-131 were released with patches for the vulnerability. Redis also rolled out OSS/CE versions 8.2.2, 8.0.4, 7.4.6, and 7.2.11, and Stack versions 7.4.0-v7 and 7.2.0-v19. According to Redis, which notes that the flaw can be exploited by manipulating the garbage collector, cloud deployments have been automatically updated to the new versions, but self-managed instances should be upgraded to the latest releases as soon as possible. Redis also recommends restricting network access to servers, enforcing strong authentication methods, ensuring protected-mode is enabled (in CE and OSS), and implementing minimum necessary permissions for user accounts that have access to the servers. “Use firewalls and network policies to limit access to trusted sources and prevent unauthorized connectivity. […] Only allow trusted identities to run Lua scripts or any other potentially risky commands,” Redis notes. There is no evidence that CVE-2025-49844 has been exploited in the wild. Unauthorized access to the database, anomalous traffic to the server, unknown use of scripting commands, unexpected crashes tracing to the Lua engine, and anomalous command execution or file system changes could indicate potential compromise. “RediShell (CVE-2025-49844) represents a critical security vulnerability that affects all Redis versions due to its root cause in the underlying Lua interpreter. With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries,” Wiz said. In an emailed comment, Tuskira co-founder and CEO Piyush Sharma underlined the risks associated with the exploitation of this vulnerability in the context of tens of thousands of servers being accessible from the internet without authentication. “This Lua-based use-after-free flaw reinforces the need for proactive exposure management. Security teams should identify misconfigured or outdated Redis builds through continuous asset discovery and validate real-world exploitability using safe simulations,” Sharma said. “To mitigate risk, disable Lua for untrusted users, monitor Redis process behavior at the endpoint and network level, and isolate exposed nodes. Redis itself should adopt safer defaults and firewall protections to reduce public exposure,” he added. Related: Microsoft and Steam Take Action as Unity Vulnerability Puts Games at Risk Related: Unauthenticated RCE Flaw Patched in DrayTek Routers Related: WireTap Attack Breaks Intel SGX Security Related: OpenSSL Vulnerabilities Allow Private Key Recovery, Code Execution, DoS Attacks

A high-severity vulnerability in the popular gaming and application editor Unity can allow attackers to load arbitrary libraries and achieve code execution. Tracked as CVE-2025-59489 (CVSS score of 8.4), the security defect resides in command-line arguments through which Unity could load and execute arbitrary code. According to security engineer RyotaK from GMO Flatt Security, the issue is related to Unity’s support for application debugging and is straightforward to exploit locally. “To support debugging Unity applications on Android devices, Unity automatically adds a handler for the intent containing the unity extra to the UnityPlayerActivity. This activity serves as the default entry point for applications and is exported to other applications,” RyotaK says. Because the extra is passed as a command-line argument to Unity and any application can send the extra to a Unity application, an attacker could control the command-line arguments that are passed to a Unity application. An attacker could build a malicious application that would extract the native library containing malicious code, and then launch the Unity application with a specific argument pointing to the malicious library, thus achieving code execution. According to the security engineer, remote exploitation of the bug is potentially possible if a malicious website can force the browser to download a specific library and load it with a given argument. Unity addressed the vulnerability with the release of the Unity Editor versions 6000.3.0b4, 6000.2.6f2, 6000.0.58f2, 2022.3.67f2, and 2021.3.56f2. It also pushed the fixes to discontinued versions down to 2019.1. According to Unity, successful exploitation of the issue could allow an attacker to execute arbitrary code remotely and access information on the devices running applications built using Unity. “Code execution would be confined to the privilege level of the vulnerable application, and information disclosure would be confined to the information available to the vulnerable application. There is no evidence of any exploitation of the vulnerability nor has there been any impact on users or customers,” Unity notes. However, it also warns that the risk of exploitation on Windows devices is higher, due to “the presence of a registered custom URI handler for a vulnerable application or handler name”. “If a custom URI scheme is present and can be invoked on the target system, an attacker who can cause that URI to be opened could trigger the vulnerable library-loading behavior without needing direct command-line access. Potential exploitation remains constrained to the privileges of the targeted application and to the data and services accessible to that process,” the vendor notes. Unity has published recommendations for developers, warning that all applications built using Unity 2017.1 and later for Android, Windows, macOS, and Linux are impacted. The company has urged developers to update the editor to the latest version and then rebuild and redeploy their applications. Microsoft says it is working on identifying potentially affected applications and games to update them, and that it has added exploitation detection rules to Microsoft Defender. “You may be using a Microsoft app or playing a Microsoft game that should be uninstalled until an update is available. We are working to update games and applications that are potentially affected by this Unity vulnerability,” the tech giant told users. Valve released a new Steam Client update which blocks the launching of games that contain in the launch request one of the four command-line parameters that Unity associates with the flaw. Developers should update their games using the Steamworks SDK or the Steamworks website and submit the update to Steam. “Unity has provided two paths to update games affected by this issue. If your game is under active development, you can use a new version of the Unity Editor to rebuild your game. For developers that are unable to rebuild their game, Unity has released patched versions of the UnityPlayer.dll runtime file that can be dropped into existing game folders,” Valve notes. Related: Unauthenticated RCE Flaw Patched in DrayTek Routers Related: Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability Related: Organizations Warned of Exploited Meteobridge Vulnerability Related: Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues

DrayTek on Thursday announced patches for an unauthenticated remote code execution (RCE) vulnerability affecting DrayOS routers. Tracked as CVE-2025-10547, the issue can be exploited via crafted HTTP or HTTPS requests sent to a vulnerable device’s web user interface. Successful exploitation of the bug, DrayTek explains in its advisory, may result in memory corruption and a system crash. In certain circumstances, it could be used to execute arbitrary code remotely, it says. “Routers are shielded from WAN-based attacks if remote access to the WebUI and SSL VPN services is disabled, or if Access Control Lists (ACLs) are properly configured,” DrayTek notes. “Nevertheless, an attacker with access to the local network could still exploit the vulnerability via the WebUI. Local access to the WebUI can be controlled on some models using LAN side VLANs and ACLs,” the company adds. The company credited ChapsVision security researcher Pierre-Yves Maes for reporting the vulnerability on July 22. DrayTek has released firmware updates that address the security defect in 35 Vigor router models, urging users to update their devices as soon as possible. However, it made no mention of the bug being exploited in the wild. DrayTek devices are widely used by prosumers and SMBs, and are known to be popular targets for hackers. Ransomware groups last year hit hundreds of organizations by exploiting an unknown flaw in DrayTek routers. Earlier this year, widespread Vigor router reboots reported across the UK, Australia, and other countries were blamed on potentially malicious TCP connection attempts targeting older models. Related: Organizations Warned of Exploited Meteobridge Vulnerability Related: Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability Related: Cisco Patches Zero-Day Flaw Affecting Routers and Switches Related: Vulnerabilities Expose Helmholz Industrial Routers to Hacking

Networking hardware maker DrayTek released an advisory to warn about a security vulnerability in several Vigor router models that could allow remote, unauthenticated actors to execute perform arbitrary code. The flaw, tracked identified as CVE-2025-10547, was reported to the vendor on July 22 by ChapsVision security researcher Pierre-Yves Maes. "The vulnerability can be triggered when unauthenticated remote attackers send crafted HTTP or HTTPS requests to the device's Web User Interface (WebUI)," reads DrayTek's security advisory. "Successful exploitation may cause memory corruption and a system crash, with the potential in certain circumstances could allow remote code execution." DrayTek noted that WAN exposure can be reduced by disabling remote WebUI/SSL VPN access or restricting it with ACLs/VLANs. However, the WebUI remains reachable over LAN, exposed to local attackers. Maes told BleepingComputer that the root cause for CVE-2025-10547 is an uninitialized stack value that can be leveraged to cause the free() function to operate on arbitrary memory locations, also known as arbitrary free(), to achieve remote code execution (RCE). The researcher successfully tested his findings by creating an exploit and running it on DrayTek devices. DrayTek's security bulletin does not mention ongoing exploitation, but it is recommended to mitigate the risk. Below are the models impacted by CVE-2025-10547, and the recommended firmware version upgrade target to mitigate the flaw: Vigor1000B, Vigor2962, Vigor3910/3912 → 4.4.3.6 or later (some models 4.4.5.1) Vigor2135, Vigor2763/2765/2766, Vigor2865/2866 Series (incl. LTE & 5G), Vigor2927 Series (incl. LTE & 5G) → 4.5.1 or later Vigor2915 Series → 4.4.6.1 or later Vigor2862/2926 Series (incl. LTE) → 3.9.9.12 or later Vigor2952/2952P, Vigor3220 → 3.9.8.8 or later Vigor2860/2925 Series (incl. LTE) → 3.9.8.6 or later Vigor2133/2762/2832 Series → 3.9.9.4 or later Vigor2620 Series → 3.9.9.5 or later VigorLTE 200n → 3.9.9.3 or later DrayTek routers, especially Vigor models, are very common in prosumer and small to medium business (SMB) environments. The list of impacted models covers a broad range, from flagship models to older routers used in DLS/telecom environments. System administrators are recommended to apply the available firmware security updates as soon as possible. Maes says he will disclose the full technical details for CVE-2025-10547 tomorrow. Update 10/3: More information about the flaw has been made available here, but the full technical details will be withheld for a while longer. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers are calling attention to multiple campaigns that are taking advantage of known security vulnerabilities and exposed Redis servers to various malicious activities, including leveraging the compromised devices as IoT botnets, residential proxies, or cryptocurrency mining infrastructure. The first set of attacks entails the exploitation of CVE-2024-36401 (CVSS score: 9.8), a critical remote code execution vulnerability impacting OSGeo GeoServer GeoTools that has been weaponized in cyber attacks since late last year. "Criminals have used the vulnerability to deploy legitimate software development kits (SDKs) or modified apps to gain passive income via network sharing or residential proxies," Palo Alto Networks Unit 42 researchers Zhibin Zhang, Yiheng An, Chao Lei, and Haozhe Zhang said in a technical report. "This method of generating passive income is particularly stealthy. It mimics a monetization strategy used by some legitimate app developers who choose SDKs instead of displaying traditional ads. This can be a well-intentioned choice that protects the user experience and improves app retention." The cybersecurity company said attackers have been probing GeoServer instances exposed to the internet since at least early March 2025, leveraging the access to drop customized executables from adversary-controlled servers. The payloads are distributed via a private instance of a file-sharing server using transfer.sh, as opposed to a conventional HTTP web server. The applications used in the campaign aim to fly under the radar by consuming minimal resources, while stealthily monetizing victims' internet bandwidth without the need for distributing custom malware. The binaries, written in Dart, are designed to interact with legitimate passive income services, discreetly using the device resources for activities like bandwidth sharing. The approach is a win-win situation for all parties involved, as developers of the applications receive payments in exchange for integrating the feature, and the cybercriminals get to profit off unused bandwidth using a seemingly innocuous channel that doesn't raise any red flags. "Once running, the executable operates covertly in the background, monitoring device resources and illicitly sharing the victim's bandwidth whenever possible," Unit 42 said. "This generates passive income for the attacker." Telemetry data gathered by the company shows that there were over 7,100 publicly exposed GeoServer instances across 99 countries, with China, the United States, Germany, Great Britain, and Singapore taking the top five spots. "This ongoing campaign showcases a significant evolution in how adversaries monetize compromised systems," Unit 42 said. "The attackers' core strategy focuses on stealthy, persistent monetization rather than aggressive resource exploitation. This approach favors long-term, low-profile revenue generation over easily detectable techniques." The disclosure comes as Censys detailed the infrastructural backbone powering a large-scale IoT botnet called PolarEdge that comprises enterprise-grade firewalls and consumer-oriented devices like routers, IP cameras, and VoIP phones by taking advantage of known security vulnerabilities. Its exact purpose is currently not known, although it's clear that the botnet isn't being used for indiscriminate mass scanning. The initial access is then abused to drop a custom TLS backdoor based on Mbed TLS that facilitates encrypted command-and-control, log cleanup, and dynamic infrastructure updates. The backdoor has been commonly observed deployed on high, non-standard ports, likely as a way to bypass traditional network scans and defensive monitoring scope. PolarEdge exhibits traits that align with an Operational Relay Box (ORB) network, with the attack surface management platform stating there are indications that the campaign started as far back as June 2023, reaching about 40,000 active devices as of this month. More than 70% of the infections are scattered across South Korea, the United States, Hong Kong, Sweden, and Canada. "ORBs are compromised exit nodes that forward traffic in order to carry out additional compromises or attacks on behalf of threat actors," security researcher Himaja Motheram said. "What makes ORBs so valuable to attackers is that they don't need to take over the device’s core function – they can quietly relay traffic in the background while the device continues to operate normally, making detection by the owner or ISP unlikely." In recent months, vulnerabilities in products from vendors such as DrayTek, TP-Link, Raisecom, and Cisco have been targeted by bad actors to infiltrate them and deploy a Mirai botnet variant codenamed gayfemboy, suggesting an expansion of the targeting scope. "The gayfemboy campaign spans multiple countries, including Brazil, Mexico, the United States, Germany, France, Switzerland, Israel, and Vietnam," Fortinet said. "Its targets also cover a broad range of sectors, such as manufacturing, technology, construction, and media or communications." Gayfemboy is capable of targeting various system architectures, including ARM, AArch64, MIPS R3000, PowerPC, and Intel 80386. It incorporates four primary functions - Monitor, which tracks threads and processes while incorporating persistence and sandbox evasion techniques Watchdog, which attempts to bind to UDP port 47272 Attacker, which launches DDoS attacks using UDP, TCP, and ICMP protocols, and enables backdoor access by connecting to a remote server to receive commands Killer, which terminates itself if it receives the command from the server or detects sandbox manipulation "While Gayfemboy inherits structural elements from Mirai, it introduces notable modifications that enhance both its complexity and ability to evade detection," security researcher Vincent Li said. "This evolution reflects the increasing sophistication of modern malware and reinforces the need for proactive, intelligence-driven defense strategies." The findings also coincide with a cryptojacking campaign undertaken by a threat actor dubbed TA-NATALSTATUS that's targeting exposed Redis servers to deliver cryptocurrency miners. The attack essentially involves scanning for unauthenticated Redis servers on port 6379, followed by issuing legitimate CONFIG, SET, and SAVE commands to execute a malicious cron job that's designed to run a shell script that disables SELinux, performs defense evasion steps, block external connections to the Redis port in order to prevent rival actors from using the initial access pathway to get in, and terminate competing mining processes (e.g., Kinsing). Also deployed are scripts to install tools like masscan or pnscan, and then launching commands like "masscan --shard" to scan the internet for susceptible Redis instances. The last step involves setting up persistence via an hourly cron job and kicking off the mining process. Cybersecurity firm CloudSEK said the activity is an evolution of an attack campaign disclosed by Trend Micro in April 2020, packing in new features to accommodate rootkit-like features to hide malicious processes and alter the timestamps of their files to fool forensic analysis. "By renaming system binaries like ps and top to ps.original and replacing them with malicious wrappers, they filter their own malware (httpgd) out of the output. An admin looking for the miner won't see it using standard tools," researcher Abhishek Mathew said. "They rename curl and wget to cd1 and wd1. This is a simple but brilliant method to bypass security products that monitor for malicious downloads specifically initiated by these common tool names."

Router e dispositivi di rete non aggiornati: il cimitero digitale dove fioriscono gli attacchi Dai firmware marci ai Comuni in balia del primo script kiddie: il rischio derivante dai router e dai dispositivi di rete non aggiornati e “abbandonati” negli uffici delle aziende viene spesso sottovalutato. Un problema che non è solo tecnico, ma anche e soprattutto culturale. Ecco come affrontarlo e risolverlo C’è un gigantesco, sporco segreto che nessuno vuole ammettere. Un segreto fatto di router impolverati, firewall lasciati in modalità di default, interfacce di amministrazione raggiungibili da qualsiasi angolo del mondo. Una montagna di apparati installati anni fa, configurati alla buona, magari “per fare prima”, e poi lasciati lì. Come se, una volta accesi, dovessero cavarsela da soli. E invece non si cavano un bel niente. Restano lì, a marcire, esposti e vulnerabili, mentre il mondo intorno cambia, mentre gli attaccanti evolvono, mentre le tecnologie si aggiornano. Loro no. Loro restano fermi. Come trappole rovesciate: non catturano nulla, ma si fanno catturare. Indice degli argomenti Se pensate che per trovare questi dispositivi servano chissà quali strumenti, siete fuori strada. Non servono APT (Advanced Persistent Threat), non servono accessi privilegiati, non serve nemmeno un grande talento tecnico. Basta aprire Shodan, digitare due query e il gioco è fatto. I risultati sono imbarazzanti. Router MikroTik con firmware vecchi di sette anni. Zyxel con interfaccia di login in chiaro. Ubiquiti con porte di gestione pubbliche. TP-Link che espongono il pannello admin senza HTTPS. DrayTek, D-Link, Netgear e Cisco RV che rispondono come se fossimo ancora nel 2010. In mezzo a tutto questo, anche dispositivi industriali, firewall entry-level, access point installati in scuole, biblioteche, sedi comunali. Tutto visibile. Tutto attaccabile. Tutto schedato. Questa montagna di dispositivi abbandonati non è solo il risultato di scelte sbagliate. È il prodotto di una cultura IT tossica, pigra, approssimativa, dove l’unico parametro di valutazione è “funziona o no?”. Se accende le lucine e fa navigare, va bene. Punto. Non c’è patch management, non c’è monitoraggio, non c’è log centralizzato. Nessuno controlla, nessuno verifica, nessuno aggiorna. Perché tanto non è compito di nessuno. E il risultato è che intere reti aziendali o pubbliche poggiano su dispositivi dimenticati, insicuri, talvolta mai più toccati dal giorno dell’installazione. Paradossalmente, i router sono diventati i punti più deboli e più duraturi delle infrastrutture digitali. Resistono più degli switch, più dei server, più delle persone che li hanno installati. Quando parli con chi gestisce queste reti, ti senti rispondere sempre allo stesso modo. “Ma chi vuoi che ci attacchi?” “Non abbiamo dati sensibili” “Non siamo un obiettivo interessante” Eppure, è proprio quel tipo di target che oggi fa gola. Non tanto per il valore in sé, quanto per la facilità di compromissione. Chi attacca cerca ciò che è debole, mal configurato, non monitorato. E quei dispositivi, te lo garantisco, sono il sogno di qualsiasi attaccante: persistenti, trascurati, connessi a tutto il resto della rete. I criminali informatici lo sanno. Entrano da lì, si muovono in silenzio, mappano la rete interna, scaricano credenziali, stabiliscono ponti per attacchi futuri. Oppure li usano come base per colpire altri obiettivi, facendoti diventare parte di una catena di attacco senza nemmeno saperlo. Il dramma è che questi attacchi non lasciano segni visibili. Non fanno rumore, non bloccano la rete, non mostrano schermate nere. Semplicemente, qualcosa si insinua e resta lì. Aspetta il momento giusto. E quando succede il disastro – perché succede, sempre – la frase che si sente dire è: “Non capiamo come sia entrato”. È entrato dalla porta di servizio. Quella che hai lasciato aperta dieci anni fa. C’è chi prova a giustificare tutto con la mancanza di fondi. È una scusa comoda. “Siamo un piccolo Comune, non possiamo permetterci un SOC”. Ma qui non stiamo parlando di tecnologie d’élite. Stiamo parlando di tenere aggiornato un router. Di non esporre un’interfaccia web all’esterno. Di cambiare la password di default. È come dire che non hai i soldi per chiudere la porta a chiave. Non è questione di budget. È questione di responsabilità. Forse è arrivato il momento di fare nomi. Non per dare in pasto le aziende ai leoni, ma per creare un po’ di sano imbarazzo. Perché a volte solo quello funziona. Quando ti accorgi che il tuo IP è finito in una lista pubblica di dispositivi esposti, forse qualcosa ti si accende nella testa. Non è il massimo dell’etica, forse. Ma siamo arrivati al punto che il rischio di non fare nulla è peggiore di quello di disturbare qualcuno. Perché quando non dai fastidio a nessuno, nessuno si muove. Quello che serve è un cambio di passo. Non possiamo più convivere con questi zombie digitali. Serve una bonifica nazionale, serve cultura, serve formazione, serve obbligo di baseline di sicurezza anche per chi gestisce reti da quattro soldi. Io sono pronto a contribuire. Posso avviare un monitoraggio OSINT su scala nazionale, mappare per categoria, zona, vendor, portare numeri veri. Posso raccogliere dati da Shodan, aggregarli, renderli leggibili. E magari cominciare da lì a costruire la prima vera mappatura dell’abbandono digitale. Perché non si può costruire sicurezza sul nulla. E oggi, sotto a tanti progetti ambiziosi, c’è solo una montagna di dispositivi dimenticati. Se pensi che il tuo router sia troppo piccolo per essere un obiettivo, sei già un obiettivo. Se pensi che tanto non succederà nulla, stai già succedendo. E se pensi che basti aspettare, ti sbagli: gli attaccanti non aspettano mai. La sveglia è suonata. Sta a noi decidere se alzarci o restare nel letto a farci bucare.