Mirai

Dysphoria Botnet Turns Compromised Routers and Cameras Into DDoS Bots and C2 Relay Nodes

The Dysphoria botnet has compromised about 296,000 internet-connected devices, largely routers, cameras, gateways, and other embedded Linux or IoT systems, and is being used to launch distributed denial-of-service (DDoS) attacks while also relaying attacker traffic through infected hosts. Reporting citing Shadowserver says the botnet has expanded beyond disruption to include residential proxy functionality, allowing malicious traffic and command-and-control relay activity to appear as if it originates from ordinary home or small-business internet connections. The exposed population reflects devices that are already compromised, rather than victims of a single confirmed exploit chain, and prior reporting linked Dysphoria infections to Telnet and SSH password attacks alongside exploitation of known vulnerabilities. Defenders are being urged to investigate exposed management services, update firmware, replace weak or reused credentials, disable unnecessary remote administration, segment IoT devices from critical networks, and retire unsupported hardware that can no longer be secured.

Dysphoria Botnet Turns Compromised Routers and Cameras Into DDoS Bots and C2 Relay Nodes | Cryptika Cybersecurity

New Mirai variant adds stealth capabilities to notorious botnet code | The Record from Recorded Future News

FortiGuard Labs disclosed a previously undocumented Linux botnet, Evooo1Bot, a Mirai-derived malware family that has been actively targeting Internet-facing devices since at least July 2026. The botnet exploits known vulnerabilities in routers, firewalls, IP cameras, and other edge hardware from vendors including Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda, and Telesquare, then deploys architecture-specific binaries from a shared loader at 91.92.40[.]118. Researchers said the malware clears bash history after infection, performs anti-analysis and anti-sandbox checks, and communicates with its command-and-control infrastructure over encrypted channels on port 443. Evooo1Bot expands on typical Mirai behavior with SSH brute-force scanning, credential sniffing for default or exposed access credentials, persistence mechanisms, and an integrated exploit module for multiple known flaws. Researchers highlighted its reverse SOCKS proxy capability as the most consequential feature because compromised edge devices can be repurposed as long-lived relay nodes to conceal attacker origin, support lateral movement, and enable follow-on intrusions into internal networks. Reported activity has been concentrated across North America, South America, Europe, India, China, and Japan, underscoring broad exposure for organizations running unpatched perimeter devices.

Multi-Functional Linux Botnet “Evooo1Bot” | FortiGuard Labs

CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation | TrendAI (US)

A critical pre-authentication remote code execution flaw, tracked as CVE-2025-55182 and dubbed React2Shell, was disclosed in React Server Components and related React Flight server-side deserialization logic used by React.js, Next.js, and similar frameworks. The vulnerability affects React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can lead to arbitrary code execution in Node.js before authentication. Public reporting said the flaw was fixed in the React repository through pull request #35277, and vendor advisories and CISA tracking indicate the issue drew urgent attention. Security researchers later reported active in-the-wild exploitation beginning almost immediately after disclosure, with mass scanning followed by deployment of Cobalt Strike, Sliver, cryptominers, reverse proxies, a Go backdoor, botnet activity, and a Node.js Secret-Hunter payload aimed at stealing credentials and secrets. Observed campaigns targeted both Linux and Windows systems, and analysis tied the root cause to improper property ownership checks in React's reviveModel function that allowed attacker-controlled serialized payloads to traverse prototype properties. The official patch replaced unsafe ownership checks with Object.prototype.hasOwnProperty.call(...), added explicit handling for __proto__, and prompted guidance to upgrade affected React and Next.js deployments and monitor exposed Server Function endpoints for exploitation attempts.

Threat news: TeamTNT stealing credentials using EC2 Instance Metadata | Sysdig

TeamTNT continued to evolve from a Linux-focused cryptojacking group into a broad cloud threat actor targeting exposed Redis, Docker, Kubernetes, Jupyter, Hadoop, PostgreSQL, Tomcat, Nginx, SSH, and other internet-facing services. Researchers tied the group to worm-like campaigns that rapidly scanned for vulnerable hosts, deployed XMRig miners, dropped Tsunami-based IRC bots including DDoS-capable variants, and used malicious container images on Docker Hub to spread payloads at scale. One TeamTNT-linked Docker Hub account reportedly served images pulled more than 150,000 times, while later campaigns showed the group abusing public registries, compromised accounts, and cloud-native tooling to infect newly exposed systems and report them back to command-and-control infrastructure. Across these operations, TeamTNT consistently paired monetization with aggressive credential theft and stealth. Investigations found the group harvesting AWS, Azure, GCP, Kubernetes, Git, NPM, Grafana, database, and storage secrets; stealing SSH keys and host data; and using tools such as Weave Scope, Peirates, BotB, MimiPenguin, Mimipy, tmate, and Gsocket to expand access and persistence. Analysts also documented detection evasion through log wiping, process hiding, LD_PRELOAD userland rootkits, the Diamorphine kernel rootkit, privileged containers with restart policies, and even disabling runc to lock out rival attackers, underscoring TeamTNT’s shift from opportunistic mining to sustained compromise of cloud and container environments.

New NULLZEREPTOOL Uses Telegram to Launch 20 DDoS Methods With Rotating Proxies

Researchers analyzed NULLZEREPTOOL, a Python-based attack framework exposed in Pastebin posts, and found a Telegram-controlled platform focused primarily on distributed denial-of-service operations. The tool links two source-code variants through shared credentials and core logic: an earlier build centered on DDoS and proxy management, and a later version that retained the same attack engine while expanding into additional modules. Analysis showed support for 20 DDoS methods, Telegram-based command and control, proxy harvesting and validation, a Flask API, key management, and logging tied to payment-card data, with evidence that the framework was tested against several websites. The newer code also introduced wireless attack functions, credential-related features, and a hierarchical botnet tasking model, but researchers said many of those additions appear incomplete or unproven. Flare found that the DDoS engine, Telegram C2, and proxy pipeline were implemented in source, while the WiFi, Bluetooth, credential-theft, and broader botnet capabilities appeared to depend on missing client artifacts or external tooling. The assessment concludes that NULLZEREPTOOL is best understood as a low-tier, Telegram-managed DDoS panel showing signs of malware-as-a-service feature expansion rather than a confirmed advanced botnet or wireless exploitation platform.

Inside NULLZEREPTOOL - Flare