Loading story…
Multiple DDoS botnets exploited CVE-2023-28771, a critical command-injection vulnerability in several Zyxel firewall models, to compromise devices and recruit them for DDoS attacks. FortiGuard Labs observed exploitation during May and June 2023 using crafted Internet Key Exchange packets sent over UDP, allowing unauthenticated attackers to execute arbitrary code. Observed payloads targeted MIPS devices and included Dark.IoT, another Mirai-derived variant, and a botnet linked to the Telegram group “SHINJI.APP | Katana botnet.” Attackers used multiple delivery servers, frequently updated payloads, and connected compromised appliances to command-and-control infrastructure.
Security researcher Kevin Beaumont separately reported internet-wide Mirai exploitation and compromises of numerous small and medium-sized business VPN appliances, although his post did not provide supporting exploitation telemetry or a verified victim count. Zyxel issued an advisory on April 25, 2023, and CISA added the flaw to its Known Exploited Vulnerabilities catalog in May. Organizations operating affected Zyxel appliances should prioritize vendor firmware fixes and assess exposed devices for compromise rather than treating the vulnerability as a theoretical risk.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
FortiGuard observed a delivery script downloaded from 171[.]22[.]136[.]15, an address previously associated with Rapperbot, that redirected delivery to 171[.]22[.]136[.]18 for additional MIPS files. The associated Mirai-derived botnet decoded its configuration using index-based XOR and transmitted the victim’s public IP address to its command-and-control infrastructure.
FortiGuard observed a script downloading “lolmips” from 92[.]118[.]39[.]16, saving it as “.zw,” and executing it with the parameter “zywall.” Researchers identified the payload as Dark.IoT.
FortiGuard Labs first discovered a botnet that it subsequently analyzed in connection with the Zyxel exploitation campaign and linked to the Telegram group “SHINJI.APP | Katana botnet.”
CISA added the Zyxel command injection vulnerability to its Known Exploited Vulnerabilities catalog in May 2023.
FortiGuard Labs observed increased attack bursts beginning in May after publication of an exploit module for CVE-2023-28771. Attackers exploited the vulnerability through Internet Key Exchange packets transmitted over UDP.
Zyxel released a security advisory for a critical command injection vulnerability reported by TRAPA Security. The flaw allows unauthenticated attackers to execute arbitrary code on affected firewalls through specially crafted packets.
Dark.IoT, a Mirai-based botnet that targets systems beyond IoT devices, first emerged in 2021. It was later identified among payloads exploiting vulnerable Zyxel firewalls.
FortiGuard identified 11 DDoS methods in an analyzed payload and matched their names to another sample using a shinji[.]app command-and-control domain. Matching method updates posted by the operator connected the botnet to the Telegram group “SHINJI.APP | Katana botnet.”
Kevin Beaumont reported that Mirai was mass-exploiting CVE-2023-28771 across the internet and claimed numerous SMB VPN appliances had been compromised. His post linked an associated payload but supplied no verified victim count or supporting exploitation telemetry.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and defenders warned that two critical zero-day vulnerabilities in Zyxel CPE devices, `CVE-2024-40890` and `CVE-2024-40891`, are being actively exploited in the wild. The flaws affect Zyxel CPE models that are now end-of-life and can enable command injection leading to full device compromise; reporting from GreyNoise highlighted active exploitation of `CVE-2024-40891`, while CSIRT.SK said Mirai-based botnet variants have been observed abusing the issue. The exposed devices appear to be attractive initial-access targets because they sit at the network edge and can be conscripted into botnets or used as footholds into victim environments. Zyxel is not expected to issue patches for the affected hardware, leaving organizations to mitigate by replacing vulnerable devices, restricting access to administrative interfaces, and increasing monitoring of HTTP and Telnet traffic for signs of exploitation and post-compromise activity.
Jul 24, 2026
Zyxel warned that **CVE-2020-9054** is a critical pre-authentication remote code execution flaw in the `weblogin.cgi` component of certain NAS and firewall products, caused by missing authentication that enables OS command injection. The company said affected systems include NAS devices running firmware **5.21 and earlier** and several UTM, ATP, and VPN firewall releases on **ZLD V4.35 Patch 0 through Patch 2**, and urged customers to install firmware updates immediately or apply workarounds for unsupported devices. Zyxel later reiterated the risk after noting that BotenaGo malware was targeting devices with known CVEs, advising organizations to patch or isolate internet-exposed systems. Palo Alto Networks' Unit 42 reported that a public proof of concept for **CVE-2020-9054** was quickly weaponized to compromise vulnerable Zyxel NAS devices and install a Mirai variant dubbed **Mukashi**. Researchers observed exploitation in the wild beginning March 12, 2020, with attackers using a shell script to fetch architecture-specific bot binaries, erase traces, and enroll devices into a botnet that scans TCP port **23**, brute-forces default credentials, and supports multiple DDoS commands. Unit 42 said the malware communicated with **45[.]84[.]196[.]75** over TCP ports **34834** and **4864**, while also binding locally to TCP port **23448** to prevent multiple infections on the same host.
Aug 15, 2026
A Mirai variant rapidly spread by targeting **ZyXEL PK5001Z** routers affected by `CVE-2016-10401`, a backdoor account flaw that exposed hardcoded Telnet credentials and a hidden path to root access. After proof-of-concept exploit code was published, attackers began scanning ports `23` and `2323` at scale, logging in with credentials including `admin/CenturyL1nk` and `admin/QwestM0dem`, then using the device's built-in super-user capability to install Mirai malware on vulnerable internet-exposed routers. Researchers reported nearly **100,000 unique scanning IPs** over roughly 60 hours, with a large share of activity traced to Argentina, particularly networks associated with Telefonica de Argentina. Netlab linked the campaign to command-and-control servers at `bigboatreps.pw:23` and `blacklister.nl:23`, and said the malware was distributed in multiple CPU-specific builds before both servers were later sinkholed by the security community. The vulnerable modem version cited in public exploit material was **PK5001Z 2.6.20.19**, a model used by CenturyLink.
Aug 15, 2026