securityaffairs.com Open in urlscan Pro
2606:4700:3031::6815:90b  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

WE VALUE YOUR PRIVACY

We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.

With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.

MORE OPTIONSAGREE

Ad


 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


MUST READ

Headlines
 * Experts warn of OSS supply chain attacks against the banking sector
 * Apple could opt to stop iMessage and FaceTime services due to the
   government's surveillance demands
 * Security Affairs newsletter Round 429 by Pierluigi Paganini – International
   edition
 * Shadowserver reported that +15K Citrix servers are likely vulnerable to
   attacks exploiting the flaw CVE-2023-3519
 * Multiple DDoS botnets were observed targeting Zyxel devices
 * CISA warns of attacks against Citrix NetScaler ADC and Gateway Devices



Ad


 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


MULTIPLE DDOS BOTNETS WERE OBSERVED TARGETING ZYXEL DEVICES

July 22, 2023  By Pierluigi Paganini




RESEARCHERS WARN OF SEVERAL DDOS BOTNETS EXPLOITING A CRITICAL FLAW TRACKED AS
CVE-2023-28771 IN ZYXEL DEVICES.

Fortinet FortiGuard Labs researchers warned of multiple DDoS botnets exploiting
a vulnerability impacting multiple Zyxel firewalls.

The flaw, tracked as CVE-2023-28771 (CVSS score: 9.8), is a command injection
issue that could potentially allow an unauthorized attacker to execute arbitrary
code on vulnerable devices.


00:00/00:00


The cause of the vulnerability is the improper error message handling in Zyxel
ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware
versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35,
and ATP series firmware versions 4.60 through 5.35. A remote, unauthenticated
attacker can trigger the vulnerability by sending specially crafted packets to
an affected device.

Zyxel addressed the vulnerability in late April and advised customers to install
the provided patches.

US CISA added the vulnerability to its Known Exploited Vulnerability to Catalog
based on evidence of active exploitation.

In June, researchers from Rapid7 also confirmed that they are tracking reports
of ongoing exploitation of CVE-2023-28771. The researchers warned that as of May
19, there were at least 42,000 instances of Zyxel devices on the public
internet. Rapid7 noted that this number only includes devices that expose their
web interfaces on the WAN, which is not a default setting.

“Since the vulnerability is in the VPN service, which is enabled by default on
the WAN, we expect the actual number of exposed and vulnerable devices to be
much higher.” reads the alert published by Rapid7. “As of May 26, the
vulnerability is being widely exploited, and compromised Zyxel devices are
being leveraged to conduct downstream attacks as part of a Mirai-based botnet.
Mirai botnets are frequently used to conduct DDoS attacks.”

The vulnerability is being actively exploited to recruit vulnerable devices in
a Mirai-like botnet.

Researchers from Shadwserver also confirmed that the issue is under active
exploitation to build a Mirai-based botnet.



Now Fortinet experts observed attacks occurring in multiple regions, including
Central America, North America, East Asia, and South Asia.

“Since the publication of the exploit module, there has been a sustained surge
in malicious activity. Analysis conducted by FortiGuard Labs has identified a
significant increase in attack bursts starting from May.” reads the post
published by Fortinet. “We also identified multiple botnets, including Dark.IoT,
a variant based on Mirai, as well as another botnet that employs customized DDoS
attack methods. In this article, we will provide a detailed explanation of the
payload delivered through CVE-2023-28771 and associated botnets.”

The experts noticed that the attackers specifically target the command injection
flaw in the Internet Key Exchange (IKE) packet transmitted over UDP on Zyxel
devices. The attackers were spotted using tools such as curl or wget to download
scripts for further malicious actions.

The script files employed in these attacks exclusively download files aimed at
the MIPS architecture, a circumstance that suggests a highly specific target.

This campaign utilized multiple servers to launch attacks, Fortinet researchers
reported that the malware updated itself within a few days to maximize the
compromise of Zyxel devices

The researchers believe that multiple actors are actively exploiting the issue
to build their own DDoS botnets. Another botnet that was spotted exploiting the
flaw is known as Katana, which is advertised on a Telegram group called
“SHINJI.APP | Katana botnet.” The threat actors behind the latter botnet
announced that they have updated the botnet’s methods and performing maintenance
tasks.

“Targeting vulnerable devices has always been a primary objective for threat
actors, and the prevalence of remote code execution attacks poses a major
concern for IoT devices and Linux servers. The presence of exposed
vulnerabilities in devices can lead to significant risks. Once an attacker gains
control over a vulnerable device, they can incorporate it into their botnet,
enabling them to execute additional attacks, such as DDoS.” concludes the
report. “To effectively address this threat, it is crucial to prioritize the
application of patches and updates whenever possible.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zyxel)


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 


CVE-2023-28771Hackinghacking newsinformation security newsIT Information
SecurityPierluigi PaganiniSecurity AffairsSecurity NewsZYXEL


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

CISA warns of attacks against Citrix NetScaler ADC and Gateway Devices

NEXT ARTICLE

Shadowserver reported that +15K Citrix servers are likely vulnerable to attacks
exploiting the flaw CVE-2023-3519

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


EXPERTS WARN OF OSS SUPPLY CHAIN ATTACKS AGAINST THE BANKING SECTOR

July 24, 2023  By Pierluigi Paganini

APPLE COULD OPT TO STOP IMESSAGE AND FACETIME SERVICES DUE TO THE GOVERNMENT’S
SURVEILLANCE DEMANDS

July 24, 2023  By Pierluigi Paganini





 * Ad


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES

 * Ad


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

CISA WARNS OF ATTACKS AGAINST CITRIX NETSCALER ADC AND GATEWAY DEVICES

The US CISA warns of cyber attacks targeting Citrix NetScaler Application
Delivery Controller (ADC) and Gateway devices. The...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version