The Mirai variant of the network botnet virus has made a comeback, targeting TP-link, NetWare and Tengda's devices to launch attacks.

CTOnews.com, June 27 (Xinhua)-- Internet zombies are rampant again these days. Recent research on security analysis website Palo Alto Networks shows that hackers have been using a variant of the zombie virus Mirai to launch attacks since March this year, exploiting vulnerabilities in network devices from multiple manufacturers. It is reported that so far, hackers have targeted 22 devices to launch attacks.

It is reported that the variant of zombie virus Mirai mainly targets 22 network equipment vulnerabilities of D-Link, Arris, Zyxel, TP-Link, Tenda, Netgear, MediaTek and other manufacturers. Hackers can exploit vulnerabilities to remotely invade these network devices, take them over and use them as "broilers" for DDoS attacks.

CTOnews.com attached vulnerability list:

Among the 22 vulnerabilities affected by ▲, it is reported that the network devices affected by these vulnerabilities include routers, digital video monitors (DVR), network video monitors (NVR), Wi-Fi receivers, access control systems, solar power monitoring systems, and so on. After using the vulnerability to obtain device permissions, hackers can use Shell commands to detect system architecture, download and deploy corresponding botnet viruses.

▲ hacker attack demo, figure source paloaltonetworksCTOnews.com noted that, in fact, the vulnerability used by hackers has been exposed before, such as TP-Link Archer A21 (AX1800) router vulnerability CVE-2023-1389, which was discovered by the vulnerability reward project Zero Day Initiative in April this year, but so far, hackers can still use this vulnerability to attack, so manufacturers also need to speed up the repair of such major vulnerabilities.

▲ CVE-2023-1389 vulnerability, graphic source nvd.nist