Beyond the Router: How the Zerobotv9 Botnet is Hijacking Enterprise Automation

Akamai SIRT observed Zerobotv9 — a Mirai-based botnet variant — actively exploiting two publicly disclosed vulnerabilities (CVE-2025-7544 in Tenda AC1206 routers and CVE-2025-68613 in the n8n automation platform) to install a payload (tol.sh); the shift to targeting n8n raises risk of lateral movement and theft of sensitive credentials in corporate environments, with attacks detected in mid‑January 2026 and public fixes available for the flaws.