TP-Link Router Botnet

A new botnet is exploiting a TP-Link Archer router vulnerability (CVE-2023-1389) to achieve command injection and remote code execution, infecting thousands of devices globally and used to distribute malware families including Mirai, Condi, and AndroxGh0st. Infections are concentrated in Brazil, Poland, the United Kingdom, Bulgaria and Turkey, with targeting observed against manufacturing, medical/healthcare, services and technology organizations in the United States, Australia, China and Mexico.