The Worm (Re)Turns, Targets Embedded Linux AirOS

A self-replicating worm is exploiting a known, patched AirOS firmware vulnerability to infect Ubiquiti airMAX and related devices worldwide. The malware uploads files, creates a backdoor account (username “mother”), blocks admin access, installs persistence to run on reboot, and scans for other AirOS devices to propagate; despite a July 2015 patch many devices remained unpatched, leading to reports of thousands of infected devices in regions such as Spain and Brazil.