New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw

Researchers observed a previously unseen botnet called Goldoon actively exploiting CVE-2015-2051 (CVSS 9.8) in D-Link DIR-645 routers to install multi-architecture payloads that download the Goldoon malware, establish persistence, connect to C2 servers, and provide at least 27 DDoS flood methods and proxying capabilities; telemetry indicates a noticeable activity spike around April 9, 2024, and operators use compromised routers for anonymization and various criminal services.