InfoSecBulletin Cybersecurity for mankind
Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious security vulnerability in TP-Link Archer AX-21 routers that could allow command injection and remote code execution.
The Hacker news reported, “The botnet exploits a remote code execution (RCE) vulnerability in TP-Link Archer routers (CVE-2023-1389) to spread itself automatically over the Internet,”.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
The first known exploitation of the flaw began in April 2023, when unknown attackers used it to deploy Mirai botnet malware. Since then, it has also been used to spread other malware, including Condi and AndroxGh0st.
Cato CTRL detected the Ballista campaign on January 10, 2025, with the latest exploitation attempt on February 17.
The attack sequence entails the use of a malware dropper, a shell script (“dropbpb.sh”) that’s designed to fetch and execute the main binary on the target system for various system architectures such as mips, mipsel, armv5l, armv7l, and x86_64.
The malware creates an encrypted command-and-control channel on port 82 to control the device.
“This allows running shell commands to conduct further RCE and denial-of-service (DoS) attacks,” the researchers said. “In addition, the malware attempts to read sensitive files on the local system.”
Ballista Botnet:
Some of the supported commands are listed below –
flooder, which triggers a flood attack
exploiter, which exploits CVE-2023-1389
start, an optional parameter that is used with the exploiter to start the module
close, which stops the module triggering function
shell, which runs a Linux shell command on the local system.
killall, which is used to terminate the service
It can terminate its previous instances and erase its presence after starting. It is designed to spread to other routers by exploiting vulnerabilities.
Censys reports over 6,000 devices infected by Ballista, mainly in Brazil, Poland, the UK, Bulgaria, and Turkey. The botnet targets manufacturing, healthcare, services, and technology organizations in the US, Australia, China, and Mexico.
“While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi,” the researchers said.
Source: catonetworks, thehackernews
