- Old TP-Link Router Error is abused again
- Threat actors build a botnet named Ballista
- They operate from Italy
Italian hackers abuse a vulnerability of the TP-Link Archer routers to spread a new botnet, CyberSecurity experts from Cato Network have reported.
The researchers said they observed a previously non-reported global Internet-of-Things (IoT) botnet campaign that began to spread in the early days of 2025.
Botnet utilizes a re-code execution (RCE) vulnerability in the routers traced as CVE-2023-1389.
Manufacture, healthcare and technological targets
This vulnerability has also been exploited for the Botnet building. Techradar Pro has reported on several occasions on several groups aimed at this particular mistake, including the dreaded Mirai. Reports came out in both 2023 and 2024.
In this campaign, Cato says attackers are first trying to drop a bash script that acts as a payload dropper that delivers malware. Botnet later switched to the use of Tor domains to be stealthis, possibly after seeing increased control from cybersecurity scientists.
“When performed, Malware sets a TLS encrypted command and control (C2) channel on port 82, which is used to fully control the compromised device,” Cato said in his writing. “This allows running Shell commands to carry out additional RCE and refusal of Service (DOS) attacks. In addition, malware is trying to read sensitive files on the local system. “
As for attribution, Cato believes, “with moderate confidence” that the threat actor is Italian-based when the IP addresses discovered originate from this country. In addition, the Italian strings discovered in the binary, causing them to dub the botnet “Ballista”.
Ballista Botnet is targeted at mostly manufacturing, medical and healthcare, services and technology organizations around the world, namely in the US, Australia, China and Mexico. With more than 6,000 Internet -connected, vulnerable devices, Cato suggests that the attack surface is relatively large and that the attacks are still underway.
The best way to defend against Ballista is to update TP-Link Archer Routers. The company dealt with this problem in firmware version 1.1.4 Build 20230219.
Via Hacker the news
