2025-01-04 18:20:16 Pacfic
D-Link Routers Targeted by Botnets Globally - 8d
Cybersecurity experts are warning about a surge in activity from two botnets, FICORA and CAPSAICIN, exploiting old vulnerabilities in D-Link routers. These botnets are leveraging decade-old weaknesses in the Home Network Administration Protocol (HNAP) interface to execute malicious commands, propagate malware, and launch DDoS attacks. FICORA, a Mirai variant, targets devices globally, while CAPSAICIN, a Kaiten variant, primarily targets East Asia. The attacks demonstrate the ongoing risks posed by outdated and unpatched network hardware, with the vulnerabilities used having been known for years.
The FICORA botnet uses a downloader script to deploy malware and brute force credentials, using UDP, TCP, and DNS protocols for DDoS attacks. The CAPSAICIN botnet focuses on rapid deployment and actively terminates rival botnet processes on infected devices to maintain control. This botnet sends operating system information to a command and control server awaiting further commands. Researchers advise users to update router firmware, implement thorough monitoring, and use cybersecurity solutions to mitigate the threats posed by these botnets, highlighting the dangers of older devices and the crucial need for regular updates.
ImgSrc: osint10x.com
References:
- siliconangle.com - Botnets leverage decade-old D-Link vulnerabilities in new attack campaigns - 8d
- @screaminggoat - Fortinet : The fun don't stop with end-of-life D-Link products: Botnets like FICORA, a Mirai variant, and CAPSAICIN, a Kaiten variant, are exploiting , , , and . Only CVE-2015-2051 is in CISA's KEV Ca - 8d
- www.fortinet.com - Fortinet : The fun don't stop with end-of-life D-Link products: Botnets like FICORA, a Mirai variant, and CAPSAICIN, a Kaiten variant, are exploiting , , , and . Only CVE-2015-2051 is in CISA's KEV Ca - 8d
- The Hacker News - FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks - 8d
- osint10x.com - Botnets Continue to Target Aging D-Link Vulnerabilities - 8d
- Security Affairs - SecurityAffairs.com article on surge in FICORA and Kaiten botnet activity. - 8d
- Cyber Security News - New Botnet Exploits D-Link Routers for Remote Control - 8d
- Osint10x - Botnets Continue to Target Aging D-Link Vulnerabilities - 8d
- SiliconANGLE - Botnets leverage decade-old D-Link vulnerabilities in new attack campaigns - 7d
- @jos1264 - FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks - 7d
- ciso2ciso.com - FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks - 7d
- cyberpress.org - Researchers observed increased activity from Mirai variant “FICORA” and Kaiten variant “CAPSAICIN” botnets in late 2024 that exploited known vulnerabilities in D-Link devices, such as CVE-2024 - 7d
- CyberInsider - Unpatched D-Link routers worldwide targeted by new malware - 7d
- CISO2CISO.COM & CYBER SECURITY GROUP - CISO2CISO article on surge in FICORA and Kaiten botnet activity. - 7d
- @jos1264 - Experts warn of a surge in activity associated FICORA and Kaiten botnets – Source: securityaffairs.com - 6d
- Vulnerability Archives ? Cybersecurity News - CVE-2024-33112 and More: How FICORA and CAPSAICIN Botnets Are Exploiting D-Link Devices - 6d
- CISO2CISO.COM & CYBER SECURITY GROUP - FICORA, CAPSAICIN Botnets Exploit Old D-Link Router Flaws for DDoS Attacks. - 6d
- @jos1264 - FICORA, CAPSAICIN Botnets Exploit Old D-Link Router Flaws for DDoS Attacks – Source:hackread.com - 6d
- ciso2ciso.com - FICORA, CAPSAICIN Botnets Exploit Old D-Link Router Flaws for DDoS Attacks – Source:hackread.com - 6d
- securityonline.info - CVE-2024-33112 and More: How FICORA and CAPSAICIN Botnets Are Exploiting D-Link Devices - 6d
- GBHackers Security | #1 Globally Trusted Cyber Security News Platform - New Botnet Exploiting D-Link Routers To Gain Control Remotely - 5d
- Security Risk Advisors - 🚩 Mirai “FICORA” and Kaiten “CAPSAICIN” Botnets Target Decade-Old D-Link Weaknesses - 5d
- Techzine Global - Malware botnets abuse outdated D-Link routers - 5d
- gbhackers.com - GBHackers article about a new botnet exploiting D-Link routers to gain control remotely. - 5d
- sra.io - 🚩 Mirai “FICORA” and Kaiten “CAPSAICIN” Botnets Target Decade-Old D-Link Weaknesses - 4d