Aggregator

一款名为“ShadowV2”的新型Mirai衍生僵尸网络恶意软件已被发现，其利用已知漏洞针对D-Link、TP-Link等厂商的物联网设备发起攻击。

FortiGuard Labs研究人员在10月亚马逊云服务大规模宕机期间监测到该攻击活动。尽管两起事件并无关联，但该僵尸网络仅在宕机期间活跃，这一特征或表明此次活动为一次测试性攻击。

攻击载体：8个跨厂商IoT设备漏洞

ShadowV2通过利用多款IoT产品的至少8个已知漏洞进行传播，涉及设备及对应漏洞如下：

- DD-WRT路由器：CVE-2009-2765

- D-Link设备：CVE-2020-25506、CVE-2022-37055、CVE-2024-10914、CVE-2024-10915

- DigiEver设备：CVE-2023-52163

- TBK设备：CVE-2024-3721

- TP-Link设备：CVE-2024-53375

其中，CVE-2024-10914是已被公开利用的命令注入漏洞，影响D-Link多款已停产（EoL）设备，厂商已明确表示不会为该漏洞提供修复补丁。 

经与厂商核实后确认，受影响设备型号同样不会获得该漏洞的修复支持。D-Link方面已更新旧版公告并添加该漏洞的CVE编号，同时发布新公告提及ShadowV2攻击活动表示已停产或终止支持的设备将不再进行开发维护，也不会收到固件更新。

另一漏洞CVE-2024-53375于2024年11月被详细披露，据悉厂商已通过测试版（beta）固件更新修复该漏洞。

攻击范围与技术特征

ShadowV2 使用的各种漏洞利用

FortiGuard Labs研究人员表示，ShadowV2的攻击流量源自IP地址198[.]199[.]72[.]27，目标涵盖路由器、网络附加存储（NAS）设备及数字视频录像机（DVR），涉及政府、科技、制造、托管安全服务提供商（MSSP）、电信、教育等七大行业，攻击范围遍布全球，包括美洲、欧洲、非洲、亚洲及大洋洲。

技术层面，该恶意软件自称为“ShadowV2 Build v1.0.0 IoT version”，与Mirai僵尸网络的LZRD变种存在相似性。其传播流程为：通过下载器脚本（binary.sh）从81[.]88[.]18[.]108服务器获取恶意程序，完成初始植入。

下载脚本

在配置加密方面，ShadowV2采用XOR编码对文件系统路径、用户代理（User-Agent）字符串、HTTP头及Mirai风格特征字符串进行加密处理。

功能上，该僵尸网络支持对UDP、TCP及HTTP协议发起分布式拒绝服务攻击，且每种协议均包含多种洪水攻击类型，控制服务器通过向受控设备（僵尸机）发送指令触发攻击。

DDoS攻击触发

通常情况下，DDoS僵尸网络的盈利模式包括向网络犯罪分子出租攻击算力，或直接勒索攻击目标（要求支付赎金以停止攻击）。但截至目前，ShadowV2的幕后操控者身份及其盈利策略尚未明确。

The Iranian threat group MuddyWater has intensified its cyber-espionage operations with the deployment of a new malicious program

The post Stealthy Spies: MuddyWater Deploys UDPGangster to Evade Network Defenses appeared first on Penetration Testing Tools.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in its newly issued mobile communications guidelines, has delivered a

The post CISA’s Stark Mobile Security Warning: Stop Using Personal VPNs Now? appeared first on Penetration Testing Tools.

Portugal has expanded its legal framework in the realm of digital security, formally establishing protections for good-faith specialists

The post Portugal Grants Legal Protection to Ethical Hackers for Vulnerability Disclosure appeared first on Penetration Testing Tools.

The new release of Tiny Core Linux illustrates just how far the philosophy of minimalism can be taken

The post Tiny Core Linux 16.2: Fully Functional Graphical OS Fits in Just 23 MB appeared first on Penetration Testing Tools.

Hackers siphoned more than 100 billion tokens from Upbit in just 54 minutes, exploiting a flaw in Solana

The post Upbit Solana Hack: 100 Billion Tokens Stolen, Exchange Delay Avoids Penalties appeared first on Penetration Testing Tools.

Sauron Fast context enumeration for newly obtained Active Directory credentials. Why Sauron? When you obtain fresh credentials (password

The post Sauron: Fast Active Directory Tool Maps Credential Privileges and Nested Groups in Seconds appeared first on Penetration Testing Tools.

Google has unveiled a new architecture for processing long sequences, Titans, along with a theoretical framework, MIRAS, which

The post Google Titans & MIRAS: New Architecture for 2M+ Token Long-Term AI Memory appeared first on Penetration Testing Tools.

Estonian security researcher Lira Rebane has unveiled an unconventional clickjacking technique that hinges on a fusion of SVG

The post Zero-JS Clickjacking: SVG Filters Exploit iFrames to Steal Cross-Origin Data appeared first on Penetration Testing Tools.

The world’s largest technology companies have begun issuing notifications to users who may have been targeted by state-linked

The post Apple & Google Issue New Spyware Alerts, Targeting Intellexa Zero-Day Victims appeared first on Penetration Testing Tools.

Cloudflare’s global infrastructure has suffered a second major outage in less than a month — and it has

The post Cloudflare Outage Caused by Frantic Patching of Critical React2Shell (CVE-2025-55182) Flaw appeared first on Penetration Testing Tools.