Recent vulnerability in Eir D1000 Router used to spread updated version of Mirai DDoS bot

Fox-IT observed a Mirai botnet variant that propagates by abusing a TR-069 SOAP Remote Code Execution (SetNTPServers) vulnerability on consumer modems: attackers supply BusyBox commands in the NTP server field to wget a payload, chmod it, and execute it. The report includes the HTTP POST request example, payload hashes (MIPS/ARM), malicious hostnames and IPs seen in honeypots, Snort IDS rules to detect exploitation attempts, mitigation recommendations for ISPs and users, and context on prior Mirai attacks and botnet scale.