Security News > 2020 > October > Ttint Botnet Targets Zero-Day Vulnerabilities in Tenda Routers
A new Mirai-based botnet is targeting zero-day vulnerabilities in Tenda routers, according to researchers at 360 Netlab, a unit of Chinese cybersecurity company Qihoo 360.
In order to circumvent detection of typical traffic generated by Mirai botnets, Ttint uses the WSS protocol for communication with the command and control server, and also uses encryption.
The botnet's activity was initially detected in November 2019, when the attackers started abusing the first zero-day vulnerability in Tenda routers.
Functions implemented in Ttint allow attackers to remotely access the router's intranet, hijack network access to possibly steal sensitive information, set traffic forwarding rules, and leverage a reverse shell as a local shell.
Tenda router users are advised to check the firmware on their devices and make sure that available updates are installed if necessary.
News URL
Related news
- PoC exploit released for RCE zero-day in D-Link EXO AX4800 routers (source)
- CISA Warns of Actively Exploited D-Link Router Vulnerabilities - Patch Now (source)
- Malware botnet bricked 600,000 routers in mysterious 2023 event (source)
- Malware botnet bricked 600,000 routers in mysterious 2023 attack (source)
- Google now pays $250,000 for KVM zero-day vulnerabilities (source)