Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks.<\/p>\n
According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further abuse.<\/p>\n
Some of the other flaws weaponized by the distributed denial-of-service (DDoS) botnet include:<\/p>\n
The decentralized nature of the P2P protocol means that an attacker can issue commands through any of the compromised nodes without having to route them through a single C2 server, thus making the botnet a lot more resilient to takedowns.<\/p>\n
"The 700+ P2P networks built into the backdoor consist of infected network device components from 80 countries and territories," the company said. "The nodes involve MikroTik routers, Hikvision cameras, VPS servers, DLink routers, CPE devices, etc."<\/p>\n
Last year, XLab also detailed a sophisticated and stealthy payload delivery framework codenamed DarkCracks that exploits compromised GLPI and WordPress sites to function as downloaders and C2 servers.<\/p>\n
Its primary objectives are to gather sensitive information from infected devices, maintain long-term access, and use the compromised, stable, high-performance devices as relay nodes to control other devices or deliver malicious payloads, effectively obfuscating the attacker’s footprint.<\/p>\n
"The compromised systems were found to belong to critical infrastructure across different countries, including school websites, public transportation systems, and prison visitor systems."<\/p>\n