Security News > 2020 > October > Ttint Botnet Targets Zero-Day Vulnerabilities in Tenda Routers
A new Mirai-based botnet is targeting zero-day vulnerabilities in Tenda routers, according to researchers at 360 Netlab, a unit of Chinese cybersecurity company Qihoo 360.
In order to circumvent detection of typical traffic generated by Mirai botnets, Ttint uses the WSS protocol for communication with the command and control server, and also uses encryption.
The botnet's activity was initially detected in November 2019, when the attackers started abusing the first zero-day vulnerability in Tenda routers.
Functions implemented in Ttint allow attackers to remotely access the router's intranet, hijack network access to possibly steal sensitive information, set traffic forwarding rules, and leverage a reverse shell as a local shell.
Tenda router users are advised to check the firmware on their devices and make sure that available updates are installed if necessary.
News URL
Related news
- Alert: Over 700,000 DrayTek Routers Exposed to Hacking via 14 New Vulnerabilities (source)
- Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited (source)
- The Rise of Zero-Day Vulnerabilities: Why Traditional Security Solutions Fall Short (source)
- Microsoft Warns of Chinese Botnet Exploiting Router Flaws for Credential Theft (source)
- Zero-days dominate top frequently exploited vulnerabilities (source)
- Botnet exploits GeoVision zero-day to install Mirai malware (source)
- Most of 2023’s Top Exploited Vulnerabilities Were Zero-Days (source)
- Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities (source)