[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjmNksssGZKMULRT24YoqigEAkZAiULfbRQRWDWd_S9E":3},{"article":4,"iocs":54,"watch_terms":68,"solutions":69,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"175987fa-25b4-4b9b-a0e6-cbeae2e51d2e","New Mirai campaign exploits RCE flaw in EoL D-Link routers","new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers-cf26ec","A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet. [...]","A Mirai-based malware campaign discovered by Akamai in March 2026 is actively exploiting CVE-2025-29635, a command-injection vulnerability in D-Link DIR-823X routers, to recruit devices into the botnet. The vulnerability was first disclosed 13 months prior but this represents the first observed in-the-wild exploitation. The threat actor deploys a Mirai variant called \"tuxnokill\" supporting multiple architectures and standard DDoS capabilities, and has also been observed exploiting similar flaws in TP-Link and ZTE routers.","New Mirai campaign actively exploits CVE-2025-29635 RCE flaw in end-of-life D-Link routers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F22\u002FD-Link.jpg","2026-04-22T20:04:46+00:00","2026-04-22T22:00:14.020152+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"D-Link","vendor",{"name":21,"type":22},"D-Link DIR-823X","product",{"name":24,"type":19},"TP-Link",{"name":26,"type":19},"ZTE",{"name":28,"type":22},"ZTE ZXV10 H108L",{"name":30,"type":19},"Akamai","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,61,65],{"type":35,"value":56,"context":57},"tuxnokill","Mirai-based botnet malware deployed via CVE-2025-29635 exploitation",{"type":35,"value":59,"context":60},"Mirai","Base malware family used in active campaign against D-Link routers",{"type":62,"value":63,"context":64},"cve","CVE-2025-29635","Command-injection RCE vulnerability in D-Link DIR-823X routers, actively exploited by Mirai campaign",{"type":62,"value":66,"context":67},"CVE-2023-1389","RCE flaw in TP-Link routers exploited by same threat actor",[18,24,26],{"controls":70,"vendors":157},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":130,"name":131,"problem":132,"products":133},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[134,142,149],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":143,"vendor_name":30,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[158],{"slug":143,"name":30,"logo_path":144,"roles":159},[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":171},"end-of-life-network-devices-exploited-in-active-botnet-campaign","End-of-Life Network Devices Exploited in Active Botnet Campaign","Cybercriminals are actively exploiting a 13-month-old command injection vulnerability (CVE-2025-29635) in end-of-life D-Link routers to build Mirai botnets for DDoS attacks. The vulnerability was publicly disclosed over a year ago, but many organizations failed to patch or replace these devices, leaving them exposed to attack. This incident demonstrates how unpatched network infrastructure becomes a critical attack vector, especially when devices reach end-of-life status and no longer receive security updates. The widespread exploitation across multiple router brands shows that attackers systematically target known vulnerabilities in consumer and small business network equipment.",[166,167,168,169,170],"CIS Control 7 - Continuous Vulnerability Management","CIS Control 1 - Inventory and Control of Enterprise Assets","NIST CSF ID.AM-2 - Software platforms and applications","NIST CSF PR.IP-12 - Vulnerability management plan","NIST SP 800-53 SI-2 - Flaw Remediation",{}]