Security News > 2020 > April > Several Botnets Using Zero-Day Vulnerability to Target Fiber Routers
Multiple botnets are targeting a zero-day vulnerability in fiber routers in an attempt to ensnare them and leverage their power for malicious purposes, security researchers warn.
Security researchers with Qihoo 360's Netlab have observed multiple attempts to target the 0day, some before the PoC was published, starting with the Moobot botnet that successfully used an exploit for the vulnerability in February.
The attacks have intensified over the past several weeks, and multiple botnets are targeting the security flaw.
Devices made by nine vendors appear to be affected, likely because they use the same OEM. The Gafgyt and Fbot botnets were observed leveraging the PoC exploit, albeit failing to successfully infect devices, mainly because the PoC needs to be chained with another vulnerability to compromise a router, the security researchers say.
To date, only Moobot appears to be actively exploiting the security flaw, as it is using its own exploit.
News URL
Related news
- Versa fixes Director zero-day vulnerability exploited in attacks (source)
- Volt Typhoon Hackers Exploit Zero-Day Vulnerability in Versa Director Servers Used by MSPs, ISPs (source)
- GeoServer Vulnerability Targeted by Hackers to Deliver Backdoors and Botnet Malware (source)
- Quad7 botnet targets more SOHO and VPN routers, media servers (source)
- Quad7 Botnet Expands to Target SOHO Routers and VPN Appliances (source)
- Windows vulnerability abused braille “spaces” in zero-day attacks (source)
- Chinese botnet infects 260,000 SOHO routers, IP cameras with malware (source)