New Mirai campaign exploits RCE flaw in EoL D-Link routers
New Mirai campaign actively exploits CVE-2025-29635 RCE flaw in end-of-life D-Link routers.
A Mirai-based malware campaign discovered by Akamai in March 2026 is actively exploiting CVE-2025-29635, a command-injection vulnerability in D-Link DIR-823X routers, to recruit devices into the botnet. The vulnerability was first disclosed 13 months prior but this represents the first observed in-the-wild exploitation. The threat actor deploys a Mirai variant called "tuxnokill" supporting multiple architectures and standard DDoS capabilities, and has also been observed exploiting similar flaws in TP-Link and ZTE routers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run D-Link?
Get an email when a new story names D-Link, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCybercriminals are actively exploiting a 13-month-old command injection vulnerability (CVE-2025-29635) in end-of-life D-Link routers to build Mirai botnets for DDoS attacks. The vulnerability was publicly disclosed over a year ago, but many organizations failed to patch or replace these devices, leaving them exposed to attack. This incident demonstrates how unpatched network infrastructure becomes a critical attack vector, especially when devices reach end-of-life status and no longer receive security updates. The widespread exploitation across multiple router brands shows that attackers systematically target known vulnerabilities in consumer and small business network equipment.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — tuxnokill
- malware — Mirai
- cve — CVE-2025-29635
- cve — CVE-2023-1389