{"vulnerability": "CVE-2020-10987", "sightings": [{"uuid": "d5088ea5-c827-4c9f-aa23-d631ef3fcc17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/2ec4ee12-9ad3-4dba-afe0-4644cf9f52b5", "content": "", "creation_timestamp": "2020-10-09T13:20:55.000000Z"}, {"uuid": "cd3b0d7c-845d-40c5-9072-34a0d4132d2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:20.000000Z"}, {"uuid": "b5b2f80c-ff7e-47a4-9889-2337ca125259", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "7b7e3a1d-79d1-4e9e-ab70-fdd78c422a35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/e439b884-82c9-422e-bee5-4425a48da4c3", "content": "", "creation_timestamp": "2020-10-09T13:36:17.000000Z"}, {"uuid": "cf259d85-a369-46dd-a022-ea40285f3952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/b14f5ca4-fb33-4da3-ad29-dcaf9e3d3fc4", "content": "", "creation_timestamp": "2020-10-09T13:24:39.000000Z"}, {"uuid": "fb13ca83-e3ba-49ca-9f6b-768b8cddb884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/cb08de75-12ec-4008-b05d-d69a6925716a", "content": "", "creation_timestamp": "2020-10-30T03:00:02.000000Z"}, {"uuid": "ca67fce6-a579-43ba-ae8a-6643882c4fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970916", "content": "", "creation_timestamp": "2024-12-24T20:21:41.692232Z"}, {"uuid": "15327bc5-34d4-4fa3-9b9e-269ffb89413b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:45.000000Z"}, {"uuid": "1c4d4743-7fbc-4e2f-86ee-e1f7aa2752e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lroeg3xky42s", "content": "", "creation_timestamp": "2025-06-15T21:02:17.908521Z"}, {"uuid": "b6af985a-2011-4718-9741-1ffbea5429ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "MISP/a41d8549-5384-5e1a-8c33-bf88e35b5a0a", "content": "", "creation_timestamp": "2025-10-14T10:31:59.000000Z"}, {"uuid": "bb3dbbb6-10ce-49ad-b682-d1a6b57b85cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-10987", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/dac68c8d-67b2-4e34-957d-6942e3e44c11", "content": "", "creation_timestamp": "2026-02-02T12:29:04.453342Z"}, {"uuid": "88214c7c-f132-43a2-b37b-a140089930a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "published-proof-of-concept", "source": "Telegram/PO0oWKD_0dQKMdfBlUdpALOxC_j0fHtsMlyXztmz6yr7XDo", "content": "", "creation_timestamp": "2025-10-24T10:33:18.000000Z"}, {"uuid": "86adbea0-0e2d-49fb-bf8a-88874c28c0a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "exploited", "source": "https://t.me/information_security_channel/40792", "content": "Netlab observed a new IoT botnet exploits two Tenda router 0-day vulnerabilities to install a Remote Access Trojan (RAT). The botnet dubbed Ttint was found to be active since November 2019, along with DDoS capabilities it includes 12 remote access functions. Ttint IoT Botnet Attack Attackers used following Tenda router 0-day vulnerability (CVE-2018-14558 & CVE-2020-10987) [\u2026]\nThe post A New Mirai based IoT RAT Spreading Through 2 0-day Vulnerabilities (https://gbhackers.com/ttint-iot-botnet/) appeared first on GBHackers On Security (https://gbhackers.com/).", "creation_timestamp": "2020-10-05T09:50:10.000000Z"}, {"uuid": "304a7c82-0dcc-4ee4-8d86-b1c506bc06ac", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0f9030ec-fd45-48e7-96bc-1128931ddee2", "content": "", "creation_timestamp": "2026-06-19T12:48:05.205333Z"}, {"uuid": "3d8afb95-d3ee-490f-a9d1-3b89823e7c83", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e129904f-b59c-41b1-9d27-5acf42065b9e", "content": "", "creation_timestamp": "2026-06-23T14:04:28.664426Z"}, {"uuid": "27b83eef-9824-4dea-94aa-c3e15bc784e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-01T20:01:14.686048Z"}, {"uuid": "c88e958e-539b-4782-a71d-0dc356471573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-01T20:02:10.140337Z"}, {"uuid": "904589ef-9153-479a-97d2-aeab33a25515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-02T01:01:32.078435Z"}, {"uuid": "883b2078-017a-4fac-b695-2b7b95802266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-02T01:02:36.420409Z"}, {"uuid": "514520f0-1556-446c-aa38-114def121933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-05T03:00:04.535852Z"}, {"uuid": "06e276ef-0fe6-4faf-94f7-0dd50d5096f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-06T00:01:00.165745Z"}, {"uuid": "f718cfe2-b47e-429b-9558-fabc4f50b82c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-07T05:00:04.943448Z"}, {"uuid": "8c69b8f0-b695-4183-9952-a831fd6be49f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10987", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-08T00:00:59.044672Z"}]}