Security News > 2020 > April > Several Botnets Using Zero-Day Vulnerability to Target Fiber Routers
Multiple botnets are targeting a zero-day vulnerability in fiber routers in an attempt to ensnare them and leverage their power for malicious purposes, security researchers warn.
Security researchers with Qihoo 360's Netlab have observed multiple attempts to target the 0day, some before the PoC was published, starting with the Moobot botnet that successfully used an exploit for the vulnerability in February.
The attacks have intensified over the past several weeks, and multiple botnets are targeting the security flaw.
Devices made by nine vendors appear to be affected, likely because they use the same OEM. The Gafgyt and Fbot botnets were observed leveraging the PoC exploit, albeit failing to successfully infect devices, mainly because the PoC needs to be chained with another vulnerability to compromise a router, the security researchers say.
To date, only Moobot appears to be actively exploiting the security flaw, as it is using its own exploit.
News URL
Related news
- PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks (source)
- Juniper Session Smart Routers Vulnerability Could Let Attackers Bypass Authentication (source)
- Ballista Botnet Exploits Unpatched TP-Link Vulnerability, Targets Over 6,000 Devices (source)
- Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks (source)
- TP-Link Router Botnet (source)
- Cisco IOS XR vulnerability lets attackers crash BGP on routers (source)
- Mozilla Patches Critical Firefox Bug Similar to Chrome’s Recent Zero-Day Vulnerability (source)