Security News > 2020 > October > Ttint Botnet Targets Zero-Day Vulnerabilities in Tenda Routers
A new Mirai-based botnet is targeting zero-day vulnerabilities in Tenda routers, according to researchers at 360 Netlab, a unit of Chinese cybersecurity company Qihoo 360.
In order to circumvent detection of typical traffic generated by Mirai botnets, Ttint uses the WSS protocol for communication with the command and control server, and also uses encryption.
The botnet's activity was initially detected in November 2019, when the attackers started abusing the first zero-day vulnerability in Tenda routers.
Functions implemented in Ttint allow attackers to remotely access the router's intranet, hijack network access to possibly steal sensitive information, set traffic forwarding rules, and leverage a reverse shell as a local shell.
Tenda router users are advised to check the firmware on their devices and make sure that available updates are installed if necessary.