InfoSecBulletin Cybersecurity for mankind
Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious security vulnerability in TP-Link Archer AX-21 routers that could allow command injection and remote code execution.
The Hacker news reported, “The botnet exploits a remote code execution (RCE) vulnerability in TP-Link Archer routers (CVE-2023-1389) to spread itself automatically over the Internet,”.
NVIDIA Releases Security Update For GPU Driver Vulnerabilities
‘SessionShark’ ToolKit Bypasses Microsoft Office 365 MFA
159 CVEs Exploited in Q1 2025 : 28.3% Within 24 Hours of Disclosure
NVIDIA NeMo Framework Vuln Allow Attackers RCE
Cisco Issued Urgent Security Advisories For Multiple Products
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing
GitLab Releases Security Update For Multiple Vulns
ISPAB president “whatsapp” got hacked via phishing link
Zyxel released patches 2 vulns in its USG FLEX H series firewalls
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked
The first known exploitation of the flaw began in April 2023, when unknown attackers used it to deploy Mirai botnet malware. Since then, it has also been used to spread other malware, including Condi and AndroxGh0st.
Cato CTRL detected the Ballista campaign on January 10, 2025, with the latest exploitation attempt on February 17.
The attack sequence entails the use of a malware dropper, a shell script (“dropbpb.sh”) that’s designed to fetch and execute the main binary on the target system for various system architectures such as mips, mipsel, armv5l, armv7l, and x86_64.
The malware creates an encrypted command-and-control channel on port 82 to control the device.
“This allows running shell commands to conduct further RCE and denial-of-service (DoS) attacks,” the researchers said. “In addition, the malware attempts to read sensitive files on the local system.”
Ballista Botnet:
Some of the supported commands are listed below –
flooder, which triggers a flood attack
exploiter, which exploits CVE-2023-1389
start, an optional parameter that is used with the exploiter to start the module
close, which stops the module triggering function
shell, which runs a Linux shell command on the local system.
killall, which is used to terminate the service
It can terminate its previous instances and erase its presence after starting. It is designed to spread to other routers by exploiting vulnerabilities.
Censys reports over 6,000 devices infected by Ballista, mainly in Brazil, Poland, the UK, Bulgaria, and Turkey. The botnet targets manufacturing, healthcare, services, and technology organizations in the US, Australia, China, and Mexico.
“While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi,” the researchers said.
Source: catonetworks, thehackernews
