InfoSecBulletin Cybersecurity for mankind
Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious security vulnerability in TP-Link Archer AX-21 routers that could allow command injection and remote code execution.
The Hacker news reported, “The botnet exploits a remote code execution (RCE) vulnerability in TP-Link Archer routers (CVE-2023-1389) to spread itself automatically over the Internet,”.
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV
Ransomware Attacks Set Records in February: New Data Shows
Cyber attack at Japanese telecom leader NTT hits 18,000 companies
Cyber heist: Pune losses Rs 6007 crore in cyber scam
Nearly 1 million airport lost and found records leaked
Exploiting CVE-2024-4577, Attackers Target Japan with Cobalt Strike
The first known exploitation of the flaw began in April 2023, when unknown attackers used it to deploy Mirai botnet malware. Since then, it has also been used to spread other malware, including Condi and AndroxGh0st.
Cato CTRL detected the Ballista campaign on January 10, 2025, with the latest exploitation attempt on February 17.
The attack sequence entails the use of a malware dropper, a shell script (“dropbpb.sh”) that’s designed to fetch and execute the main binary on the target system for various system architectures such as mips, mipsel, armv5l, armv7l, and x86_64.
The malware creates an encrypted command-and-control channel on port 82 to control the device.
“This allows running shell commands to conduct further RCE and denial-of-service (DoS) attacks,” the researchers said. “In addition, the malware attempts to read sensitive files on the local system.”
Ballista Botnet:
Some of the supported commands are listed below –
flooder, which triggers a flood attack
exploiter, which exploits CVE-2023-1389
start, an optional parameter that is used with the exploiter to start the module
close, which stops the module triggering function
shell, which runs a Linux shell command on the local system.
killall, which is used to terminate the service
It can terminate its previous instances and erase its presence after starting. It is designed to spread to other routers by exploiting vulnerabilities.
Censys reports over 6,000 devices infected by Ballista, mainly in Brazil, Poland, the UK, Bulgaria, and Turkey. The botnet targets manufacturing, healthcare, services, and technology organizations in the US, Australia, China, and Mexico.
“While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi,” the researchers said.
Source: catonetworks, thehackernews
