Loading story…
CUJO AI’s IoT botnet research found a sharp increase in malware carrying vulnerability exploits, while an older Huawei router flaw remained overwhelmingly dominant. Across protected consumer networks monitored from July 2022 through January 2023, researchers identified 6,471 malicious ELF binaries, including 1,685 containing exploits. The exploit-bearing share rose from 8% in the company’s 2021 study to 26%, and the number of targeted vulnerabilities increased from 20 to 55. CVE-2017-17215, affecting Huawei HG532 routers, appeared in 1,625 exploit-bearing binaries. Zerobot carried the largest exploit set, with 22 entries; Sysrv, Enemybot and an unnamed Go-based sample also incorporated relatively recent vulnerabilities.
The findings highlight persistent exposure from unpatched legacy devices alongside newer attack paths. Separate references identify security issues in Eir’s D1000 modem and Realtek SDK components used across hundreds of thousands of downstream devices, underscoring the need to track both device firmware and embedded dependencies. Qualys’ PwnKit advisory covers CVE-2021-4034, a local privilege-escalation flaw in polkit’s pkexec, rather than a standalone remote entry point. Defenders should prioritize exposed-device inventories, firmware remediation, replacement of unsupported equipment and network segmentation. CUJO AI also documented malformed or potentially nonfunctional exploit implementations: an exploit’s presence in malware does not establish successful compromise.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
CUJO AI investigated IoT botnet activity in protected consumer networks from early July 2022 through the end of January 2023. The investigation classified 6,471 distinct ELF binaries as malicious, including 1,685 containing exploits targeting a total of 55 vulnerabilities.
During a four-month study in 2021, CUJO AI found that 8% of analyzed malicious binaries contained vulnerability exploits, targeting 20 vulnerabilities. Approximately 83% of exploit-bearing binaries contained multiple exploits.
CUJO AI reported that Huawei HG532 vulnerability CVE-2017-17215 appeared in approximately 96% of exploit-bearing binaries, while Go-based Zerobot carried the largest exploit set, with 22 entries. The report also documented Sysrv, Enemybot, and an unnamed Go-based sample carrying newer exploits, but identified malformed or potentially nonfunctional implementations and cautioned that exploit presence did not establish successful compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
owasp.org
Open sourceonekey.com
Open sourcecujo.com
Open sourcequalys.com
Open sourcedevicereversing.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CUJO AI researchers collected 438 malicious scripts and 2,792 Linux ELF binaries during August–November 2021 monitoring of IoT botnets, with Mirai and Gafgyt variants predominating. Only 8% of the binaries contained vulnerability-exploitation functionality. Researchers identified 20 targeted vulnerabilities, characterized as command-injection flaws enabling remote code execution; most were several years old. The most frequently observed flaw, CVE-2017-17215 in Huawei routers, was commonly paired with CVE-2014-8361 in the Realtek SDK. Alongside continued exploitation of older flaws, the Dark IoT Mirai variant incorporated CVE-2021-35395 within four days of its publication, demonstrating how quickly botnet operators could adopt newly disclosed vulnerabilities. The findings reinforce the need for strong device credentials, regular firmware updates, and rapid patching of internet-exposed IoT devices. **The 8% figure does not represent the full role of exploits in infections**: the analysis excluded exploitation performed before malware binaries were downloaded.
Oct 9, 2026
A threat actor using the alias **Anarchy** reportedly assembled a botnet of roughly **18,000 compromised Huawei HG532 routers in a single day** by exploiting **`CVE-2017-17215`**, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential **DDoS** or other criminal activity. Public exploit details for **`CVE-2017-17215`** showed that attackers could send a crafted **SOAP** request to the router's **UPnP `WANPPPConnection` service on port `37215`** and inject shell commands through the `NewStatusURL` field of the `Upgrade` action, using the default credentials **`dslf-config/admin`**. Reporting also indicated that the actor planned to expand operations by targeting **`CVE-2014-8361`** in **Realtek-based routers** via **port `52869`**, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Sep 3, 2026
Attackers exploited **CVE-2017-17215**, a command-injection vulnerability in Huawei HG532 home routers, to distribute the Mirai-derived **Satori/Okiru** malware. Check Point reported hundreds of thousands of exploitation attempts worldwide in 2017. The flaw exposed a TR-064 service on WAN port 37215, allowing attackers to abuse the DeviceUpgrade process to download and execute malware. Infected routers could launch command-and-control-directed UDP and TCP floods against individual targets or subnets. Researchers linked the campaign to the suspected operator Nexus Zeta, but attribution remained unconfirmed. Huawei patched the vulnerability following coordinated disclosure and recommended firewall protections and changing default passwords. GreyNoise data dated October 9, 2026, lists **1,545 scanner IP addresses** matching its Huawei HG532 CVE-2017-17215 remote-code-execution attempt tag, all classified as malicious and not spoofable. Pakistan accounts for 1,146 source IPs, and every listed scanner targeted the United States. Overlapping signatures include Mirai scanning and exploitation attempts against GPON routers and CCTV devices; the ten displayed records were last seen that day and had unknown actor attribution. These observations establish continued scanning and attempted exploitation—not confirmed infections or continuity with the original Satori campaign. Organizations should verify that affected routers are patched or retired, restrict WAN access to management services, and monitor for exploitation attempts against port 37215.
Oct 9, 2026