{"uuid": "f28e7bf0-bcd8-48bc-ab3b-a6336f6c7f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34538", "type": "seen", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-01T20:01:14.635283Z"}