Zerobot Malware Exploiting Tenda Command Injection Vulnerabilities to Deploy Malware

A resurfaced Mirai-based botnet variant, zerobotv9, is actively exploiting critical RCE vulnerabilities in Tenda AC1206 routers and the n8n workflow automation platform to deploy a UPX-packed Mirai payload; researchers observed exploitation in mid-January 2026, identified C2 infrastructure (0bot.qzz.io) and several malicious IPs, and provided IoCs and mitigation guidance including patching, upgrades, and network blocking.