Why is my Mitel phone DDoSing strangers? Oh, it was roped into a new Mirai botnet

Akamai's Security Intelligence team identified Aquabotv3, a new Mirai-based botnet variant actively exploiting Mitel phone command-injection vulnerability CVE-2024-41710 (affecting Mitel 6800/6900 series) to install Mirai malware and form DDoS-capable botnets; the strain introduces a novel capability to report received kill signals back to its C2. Akamai observed exploit attempts matching a published PoC in their honeypots, and the malware also spreads via several other known RCE vulnerabilities and architectures (x86, ARM). Mitel issued a patch in July for affected firmware, and default/weak credentials on IP phones increase exploitation risk.