A new malware botnet named ‘AndoryuBot’ is targeting a critical-severity flaw in the Ruckus Wireless Admin panel to infect unpatched Wi-Fi access points for use in DDoS attacks.
Tracked as CVE-2023-25717, the flaw impacts all Ruckus Wireless Admin panels version 10.4 and older, allowing remote attackers to perform code execution by sending unauthenticated HTTP GET requests to vulnerable devices.
The botnet malware aims to enlist vulnerable devices to its DDoS swarm that it operates for profit.
The malware will receive commands from the command and control server that tell it the DDoS type, the target IP address, and the port number to attack.
The malware’s operators rent their firepower to other cybercriminals who want to launch DDoS attacks, accepting cryptocurrency payments for their services.
To prevent botnet malware infections, apply available firmware updates, use strong device administrator passwords, and disable remote admin panel access if not needed.
