New Mirai campaign exploits RCE flaw in EoL D-Link routers

Akamai SIRT detected active exploitation of D-Link DIR-823X command-injection CVE-2025-29635 in March 2026 where attackers send POST requests to download and execute a shell script that installs a Mirai-based botnet called "tuxnokill" (multi-architecture, DDoS capabilities); the campaign also leverages RCEs in TP-Link and ZTE devices, and affected routers are end-of-life making patches unlikely — users are advised to upgrade, disable remote admin, and change default credentials.