router-ddos

Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks

Share:

A Mirai botnet variant has been found exploiting a newly disclosed security flaw impacting Four-Faith industrial routers since early November 2024 with the goal of conducting distributed denial-of-service (DDoS) attacks.

The botnet maintains approximately 15,000 daily active IP addresses, with the infections primarily scattered across China, Iran, Russia, Turkey, and the United States.

Exploiting an arsenal of over 20 known security vulnerabilities and weak Telnet credentials for initial access, the malware is known to have been active since February 2024. The botnet has been dubbed “gayfemboy” in reference to the offensive term present in the source code.

QiAnXin XLab said it observed the malware leveraging a zero-day vulnerability in industrial routers manufactured by China-based Four-Faith to deliver the artifacts as early as November 9, 2024.

The vulnerability in question is CVE-2024-12856 (CVSS score: 7.2), which refers to an operating system (OS) command injection bug affecting router models F3x24 and F3x36 by taking advantage of unchanged default credentials.

Late last month, VulnCheck told The Hacker News that the vulnerability has been exploited in the wild to drop reverse shells and a Mirai-like payload on compromised devices.

Some of the other security flaws exploited by the botnet to extend its reach and scale include CVE-2013-3307, CVE-2013-7471, CVE-2014-8361, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2020-25499, CVE-2020-9054, CVE-2021-35394, CVE-2023-26801, CVE-2024-8956, and CVE-2024-8957.

Once launched, the malware attempts to hide malicious processes and implements a Mirai-based command format to scan for vulnerable devices, update itself, and launch DDoS attacks against targets of interest.

DDoS attacks leveraging the botnet have targeted hundreds of different entities on a daily basis, with the activity scaling a new peak in October and November 2024. The attacks, while lasting between 10 and 30 seconds, generate traffic around 100 Gbps.

The disclosure comes weeks after Juniper Networks warned that Session Smart Router (SSR) products with default passwords are being targeted by malicious actors to drop the Mirai botnet malware. Akamai has also revealed Mirai malware infections that weaponize a remote code execution flaw in DigiEver DVRs.

“DDoS has become one of the most common and destructive forms of cyber attacks,” XLab researchers said. “Its attack modes are diverse, attack paths are highly concealed, and it can employ continuously evolving strategies and techniques to conduct precise strikes against various industries and systems, posing a significant threat to enterprises, government organizations, and individual users.”

The development also comes as threat actors are leveraging susceptible and misconfigured PHP servers (e.g., CVE-2024-4577) to deploy a cryptocurrency miner called PacketCrypt.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
12:48 am, Jul 2, 2025
weather icon 21°C
L: 20° | H: 22°
scattered clouds
Humidity: 75 %
Pressure: 1015 mb
Wind: 7 mph NNE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 33%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:48 am
Sunset: 9:20 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
20° | 22°°C 0.38 mm 38% 11 mph 79 % 1022 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
14° | 26°°C 0 mm 0% 13 mph 55 % 1028 mb 0 mm/h
Fri Jul 04 10:00 pm
weather icon
15° | 26°°C 0 mm 0% 12 mph 57 % 1028 mb 0 mm/h
Sat Jul 05 10:00 pm
weather icon
15° | 25°°C 1 mm 100% 15 mph 89 % 1022 mb 0 mm/h
Sun Jul 06 10:00 pm
weather icon
14° | 19°°C 1 mm 100% 13 mph 81 % 1012 mb 0 mm/h
Today 1:00 am
weather icon
20° | 21°°C 0 mm 0% 5 mph 75 % 1015 mb 0 mm/h
Today 4:00 am
weather icon
18° | 20°°C 0 mm 0% 6 mph 76 % 1015 mb 0 mm/h
Today 7:00 am
weather icon
18° | 19°°C 0.2 mm 20% 5 mph 79 % 1016 mb 0 mm/h
Today 10:00 am
weather icon
21° | 21°°C 0.2 mm 20% 6 mph 71 % 1017 mb 0 mm/h
Today 1:00 pm
weather icon
19° | 19°°C 0.38 mm 38% 4 mph 69 % 1018 mb 0 mm/h
Today 4:00 pm
weather icon
23° | 23°°C 0.35 mm 35% 6 mph 41 % 1019 mb 0 mm/h
Today 7:00 pm
weather icon
23° | 23°°C 0.01 mm 1% 11 mph 28 % 1020 mb 0 mm/h
Today 10:00 pm
weather icon
18° | 18°°C 0 mm 0% 10 mph 34 % 1022 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€89,303.86
-1.52%
Ethereum(ETH)
€2,030.01
-3.68%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€1.84
-3.29%
Solana(SOL)
€124.13
-5.50%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.133204
-4.74%
Shiba Inu(SHIB)
€0.000009
-2.32%
Pepe(PEPE)
€0.000008
-5.46%
Scroll to Top