InfoSecBulletin Cybersecurity for mankind
Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious security vulnerability in TP-Link Archer AX-21 routers that could allow command injection and remote code execution.
The Hacker news reported, “The botnet exploits a remote code execution (RCE) vulnerability in TP-Link Archer routers (CVE-2023-1389) to spread itself automatically over the Internet,”.
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
The first known exploitation of the flaw began in April 2023, when unknown attackers used it to deploy Mirai botnet malware. Since then, it has also been used to spread other malware, including Condi and AndroxGh0st.
Cato CTRL detected the Ballista campaign on January 10, 2025, with the latest exploitation attempt on February 17.
The attack sequence entails the use of a malware dropper, a shell script (“dropbpb.sh”) that’s designed to fetch and execute the main binary on the target system for various system architectures such as mips, mipsel, armv5l, armv7l, and x86_64.
The malware creates an encrypted command-and-control channel on port 82 to control the device.
“This allows running shell commands to conduct further RCE and denial-of-service (DoS) attacks,” the researchers said. “In addition, the malware attempts to read sensitive files on the local system.”
Ballista Botnet:
Some of the supported commands are listed below –
flooder, which triggers a flood attack
exploiter, which exploits CVE-2023-1389
start, an optional parameter that is used with the exploiter to start the module
close, which stops the module triggering function
shell, which runs a Linux shell command on the local system.
killall, which is used to terminate the service
It can terminate its previous instances and erase its presence after starting. It is designed to spread to other routers by exploiting vulnerabilities.
Censys reports over 6,000 devices infected by Ballista, mainly in Brazil, Poland, the UK, Bulgaria, and Turkey. The botnet targets manufacturing, healthcare, services, and technology organizations in the US, Australia, China, and Mexico.
“While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi,” the researchers said.
Source: catonetworks, thehackernews
