InfoSecBulletin Cybersecurity for mankind
Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious security vulnerability in TP-Link Archer AX-21 routers that could allow command injection and remote code execution.
The Hacker news reported, “The botnet exploits a remote code execution (RCE) vulnerability in TP-Link Archer routers (CVE-2023-1389) to spread itself automatically over the Internet,”.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The first known exploitation of the flaw began in April 2023, when unknown attackers used it to deploy Mirai botnet malware. Since then, it has also been used to spread other malware, including Condi and AndroxGh0st.
Cato CTRL detected the Ballista campaign on January 10, 2025, with the latest exploitation attempt on February 17.
The attack sequence entails the use of a malware dropper, a shell script (“dropbpb.sh”) that’s designed to fetch and execute the main binary on the target system for various system architectures such as mips, mipsel, armv5l, armv7l, and x86_64.
The malware creates an encrypted command-and-control channel on port 82 to control the device.
“This allows running shell commands to conduct further RCE and denial-of-service (DoS) attacks,” the researchers said. “In addition, the malware attempts to read sensitive files on the local system.”
Ballista Botnet:
Some of the supported commands are listed below –
flooder, which triggers a flood attack
exploiter, which exploits CVE-2023-1389
start, an optional parameter that is used with the exploiter to start the module
close, which stops the module triggering function
shell, which runs a Linux shell command on the local system.
killall, which is used to terminate the service
It can terminate its previous instances and erase its presence after starting. It is designed to spread to other routers by exploiting vulnerabilities.
Censys reports over 6,000 devices infected by Ballista, mainly in Brazil, Poland, the UK, Bulgaria, and Turkey. The botnet targets manufacturing, healthcare, services, and technology organizations in the US, Australia, China, and Mexico.
“While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi,” the researchers said.
Source: catonetworks, thehackernews
