Cybersecurity articles tagged #Mirai on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/evooo1bot-linux-botnet-turns-routers-into-socks5-relayshttps://runtimerebel.com/blog/evooo1bot-linux-botnet-turns-routers-into-socks5-relaysA new Mirai-based modular Linux botnet called Evooo1Bot targets internet routers, turning them into SOCKS5 traffic relay nodes.Sat, 15 Aug 2026 16:14:07 GMTDDoSCredential TheftD LinkTP LinkMiraihttps://runtimerebel.com/blog/tengu-botnet-exploits-linux-watchdog-for-reboot-based-persistencehttps://runtimerebel.com/blog/tengu-botnet-exploits-linux-watchdog-for-reboot-based-persistenceThe Mirai-derived Tengu botnet utilizes hardware watchdog timers to trigger reboots when its process is terminated, ensuring persistence on Linux devices.Tue, 28 Jul 2026 17:36:22 GMTTenguMiraiLinux BotnetIot SecurityDDoShttps://runtimerebel.com/blog/analyzing-internet-background-radiation-and-automated-scanning-trendshttps://runtimerebel.com/blog/analyzing-internet-background-radiation-and-automated-scanning-trendsAn analysis of automated cybercrime traffic and internet background radiation, detailing how botnets exploit vulnerabilities like CVE-2017-17215.Thu, 25 Jun 2026 09:22:13 GMTAutomated ScanningBotnetsMiraiCVE-2017-17215Internet Background Radiationhttps://runtimerebel.com/blog/gafgyt-and-mirai-variants-target-iot-devices-via-cve-2017-17215https://runtimerebel.com/blog/gafgyt-and-mirai-variants-target-iot-devices-via-cve-2017-17215Analysis of Gafgyt and Mirai botnet activity targeting IoT devices through RCE vulnerabilities such as CVE-2017-17215 and CVE-2014-2320.Fri, 08 May 2026 08:41:11 GMTGafgytMiraiCVE-2017-17215Iot SecurityBotnethttps://runtimerebel.com/blog/cve-2025-29635-mirai-exploits-eol-d-link-routershttps://runtimerebel.com/blog/cve-2025-29635-mirai-exploits-eol-d-link-routersA new Mirai campaign actively exploits CVE-2025-29635, a command-injection RCE in EoL D-Link DIR-823X routers, to expand its IoT botnet for DDoS attacks.Wed, 22 Apr 2026 20:25:12 GMTMiraiD Link DIR 823XCVE-2025-29635IoT BotnetRCECommand InjectionDDoShttps://runtimerebel.com/blog/tp-link-archer-ax21-rce-via-cve-2023-1389-mitigation-guidehttps://runtimerebel.com/blog/tp-link-archer-ax21-rce-via-cve-2023-1389-mitigation-guideHackers continue targeting discontinued TP-Link Archer AX21 routers with CVE-2023-1389, though many exploitation attempts currently fail to execute payloads.Mon, 20 Apr 2026 08:54:58 GMTCVE-2023-1389TP LinkArcher AX21MooBotMiraiCommand Injectionhttps://runtimerebel.com/blog/nexcorium-mirai-variant-exploits-cve-2024-3721-in-tbk-dvr-botnethttps://runtimerebel.com/blog/nexcorium-mirai-variant-exploits-cve-2024-3721-in-tbk-dvr-botnetSecurity researchers identify Nexcorium, a new Mirai variant targeting TBK DVRs and EoL TP-Link routers via CVE-2024-3721 for large-scale DDoS attacks.Sat, 18 Apr 2026 08:19:28 GMTNexcoriumMiraiCVE-2024-3721TBK DVRIoTDDoShttps://runtimerebel.com/blog/cve-2024-32113-apache-ofbiz-rce-exploited-for-mirai-botnethttps://runtimerebel.com/blog/cve-2024-32113-apache-ofbiz-rce-exploited-for-mirai-botnetTechnical analysis of CVE-2024-32113 exploitation in Apache OFBiz. Learn how attackers use path traversal to deploy Mirai botnet malware and how to patch.Mon, 06 Apr 2026 05:02:01 GMTCVE-2024-32113Apache OFBizMiraiRCEPath Traversal