DDoS Botnet Archives

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

20Apr

By RBNo Comments

News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

According to research from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42, threat actors are using security holes in TBK DVR and end-of-life (EoL) TP-Link Wi-Fi routers to install Mirai-botnet variants on vulnerable devices. CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recording devices, has been reported to be exploited by the attack targeting TBK DVR devices in order to distribute a Mirai version known as Nexcorium. Due to their extensive use, lack of updating, and frequently inadequate security settings, IoT devices are becoming more and more popular targets for large-scale assaults, according to security researcher Vincent Li. "To obtain initial access and install malware that can en...

New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC LDAP

Thousands of public domain controllers (DCs) worldwide might be enlisted using a new attack method to build a malicious botnet and utilize it to launch potent distributed denial-of-service (DDoS) attacks. Researchers Or Yair and Shahak Morag of SafeBreach have dubbed the strategy Win-DDoS. They presented their findings at today's DEF CON 33 security conference. In a post shared with The Hacker News, Yair and Morag stated, As we investigated the complexities of the Windows LDAP client code, we found a significant flaw that allowed us to manipulate the URL referral process to point DCs at a victim server to overwhelm it. Consequently, we developed Win-DDoS, a method that would allow an attacker to use the strength of tens of thousands of public DCs worldwide to build a malicious bo...

Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet

Threat actors are using a variation of the AISURU botnet known as AIRASHI to launch distributed denial-of-service (DDoS) attacks by taking advantage of an unidentified zero-day vulnerability in Cambium Networks' cnPilot routers. QiAnXin XLab claims that starting June 2024, the attackers have taken advantage of the security vulnerability. To stop additional misuse, other information regarding the flaws has been kept secret. The distributed denial-of-service (DDoS) botnet has also weaponized vulnerabilities that affect AVTECH IP cameras, LILIN DVRs, and Shenzhen TVT devices, including CVE-2013-3307, CVE-2016-20016, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-3573, CVE-2022-40005, CVE-2022-44149, and CVE-2023-28771. According to XLab, the operator of AIRAS...