Loading story…
Attackers exploited CVE-2022-46169, a critical unauthenticated command injection vulnerability in the Cacti network monitoring tool, to deploy Mirai-family malware and Perl-based IRC bots. The flaw, rated CVSS 9.8, allows remote code execution through Cacti’s remote_agent.php endpoint. FortiGuard Labs observed attack bursts in January and March 2023 involving this flaw and CVE-2021-35394 in Realtek devices to distribute Moobot and ShellBot. Moobot is a Mirai-derived botnet that terminates competing bot processes; observed ShellBot variants support distributed denial-of-service attacks, reverse shells, port scanning, and, in some cases, additional malware installation.
Censys identified 6,427 internet-exposed Cacti hosts in January 2023, including 1,637 confirmed vulnerable instances; versions could not be determined for every host, and only 26 hosts with identifiable versions were running a release unaffected by the flaw. Beyond botnet recruitment, compromised Cacti systems can expose network-device details and internal IP addresses that help attackers expand their foothold. A Cacti fix was already available, making prompt patching of affected Cacti deployments and Realtek devices, reduced internet exposure, and strong passwords key defensive priorities.
See which actors are running it and whether you're in range.
13 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs observed further attack bursts targeting Cacti CVE-2022-46169 and Realtek CVE-2021-35394 to distribute Moobot and ShellBot malware.
The server associated with the 'LiGhT's Modded perlbot v2' ShellBot variant was created in March 2023. FortiGuard subsequently observed hundreds of victims in its IRC channel.
Shadowserver observed exploitation attempts against CVE-2022-46169 delivering malware. Observed payloads included Mirai and a Perl-based IRC botnet that opened reverse shells and instructed compromised hosts to perform port scans.
SonarSource published a technical write-up of its Cacti vulnerability finding and a short demonstration video.
Shadowserver observed increased CVE-2022-46169 exploitation attempts during the week preceding the January 15 report. Its total observed attempts remained below two dozen.
FortiGuard Labs observed attack bursts exploiting Realtek CVE-2021-35394 and Cacti CVE-2022-46169 to distribute Moobot and ShellBot. ShellBot activity began in January and primarily targeted Cacti.
Technical details and proof-of-concept exploit code for CVE-2022-46169 began appearing publicly.
An advisory published in early December warned of CVE-2022-46169, a Cacti command injection vulnerability rated 9.8 out of 10. The flaw permits unauthenticated arbitrary code execution.
FortiGuard Labs observed Moobot, a Mirai-derived botnet, attacking Hikvision products.
FortiGuard published analysis and indicators for Moobot and three captured ShellBot variants: 'PowerBots (C) GohacK,' 'LiGhT's Modded perlbot v2,' and 'B0tchZ 0.2a.' The analysis documented Moobot's termination of competing bots, IRC-based ShellBot command and control, and additional-malware installation capabilities in some ShellBot variants.
Censys identified 6,427 internet-exposed Cacti hosts and confirmed that 1,637 were vulnerable to CVE-2022-46169. Only 26 hosts with identifiable versions ran a non-vulnerable release, although version information was unavailable for many hosts.
More recent attempts observed by Shadowserver checked whether Cacti instances were vulnerable rather than delivering malware.
Cacti's developer released an update fixing the vulnerability and provided guidance to prevent command injection and authorization bypass.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 28, 2026
Attackers were observed exploiting **`CVE-2020-9020`**, a critical remote command execution flaw in **Iteris Vantage Velocity** field units, to deploy a **Satori** variant of the **Mirai** botnet. The activity targeted versions **2.3.1, 2.4.2, and 3.0** through crafted HTTP requests to the vulnerable **`/cgi-bin/timeconfig.py`** endpoint, injecting commands via the **`htmlNtpServer`** parameter and downloading malware from **`198.23.238.203`**. The malware was built to compromise multiple CPU architectures and then scan random hosts over **Telnet port 23** using an embedded password dictionary, behavior consistent with Mirai-style propagation. Researchers said infected traffic-monitoring devices could be repurposed for **botnet enrollment, DDoS operations, or data leakage**, and noted communications with a suspected command-and-control service over **SSL on port 5684**; affected organizations were urged to patch or upgrade exposed systems.
Aug 14, 2026