Mirai Strikes Again: GeoVision and Samsung Devices Fall Victim to Botnet Exploits
Threat actors are exploiting security flaws in GeoVision end-of-life IoT devices to herd them into a Mirai botnet. The Akamai Security Intelligence and Response Team observed the trickery, involving command injection flaws CVE-2024-6047 and CVE-2024-11120. To avoid botnet recruitment, users should upgrade devices before they become zombie minions!
Hot Take:
Who knew that the end-of-life (EoL) devices could have a second career as unwitting botnet soldiers? It’s a tale of retirement gone rogue, with GeoVision devices not only refusing to rest in peace but also joining the Mirai botnet army. Maybe it’s time for these devices to get an upgrade and retire gracefully before they start demanding pensions and health benefits!
Key Points:
- GeoVision EoL IoT devices are being exploited for Mirai botnet recruitment.
- Exploits target two OS command injection flaws, CVE-2024-6047 and CVE-2024-11120.
- The botnet uses the /DateSetting.cgi endpoint to download and execute the Mirai malware.
- Evidence suggests overlap with the InfectedSlurs campaign.
- Samsung MagicINFO 9 Server flaw CVE-2024-7399 also exploited for botnet activities.
Already a member? Log in here