New Aquabotv3 botnet malware targets Mitel command injection flaw

Akamai SIRT observed a new Mirai-derived botnet variant, Aquabotv3, actively exploiting CVE-2024-41710 in Mitel 6800/6900-series SIP phones to inject commands during boot, download architecture-specific payloads, establish persistence, and recruit devices into a DDoS botnet; the report explains the exploitation chain, propagation via multiple known IoT vulnerabilities and SSH/Telnet brute-forcing, and includes IoCs and detection rules.