Mirai Botnet Targets Flaw in Discontinued D-Link Routers

Summary

Akamai has detected active exploitation of CVE-2025-29635, a command injection vulnerability in discontinued D-Link DIR-823X series routers, by Mirai botnet operators. The flaw was publicly disclosed over a year ago with proof-of-concept code published on GitHub; attackers craft malicious POST requests to execute arbitrary commands. The observed attacks deliver Mirai payloads with distinctive characteristics including XOR encoding and hardcoded downloader IPs, targeting devices that no longer receive vendor security updates.

Full text

A Mirai botnet is targeting discontinued D-Link routers impacted by a command injection vulnerability disclosed a year ago, Akamai reports. Tracked as CVE-2025-29635, the security defect exists because an attacker-controllable function value is copied without validation, and can be exploited through crafted POST requests. “The router extracts the value that ends up in the command buffer from the request body without checking which form field it came from,” Akamai notes. The observed exploitation attempts, it says, target the same code and trigger the same system call as a proof-of-concept (PoC) exploit published last year on GitHub, which has since been removed. As part of the observed execution path, a shell script is loaded to download and run a payload that has numerous Mirai characteristics, including XOR encoding, a hardcoded console execution string, and a hardcoded downloader IP. The exploited issue exists in D-Link DIR-823X series router firmware versions 240126 and 24082. The affected devices were discontinued last year and no longer receive software updates from the vendor.Advertisement. Scroll to continue reading. “D-Link strongly recommends that this product be retired and cautions that any further use of this product may be a risk to devices connected to it,” the company warned in September. The hackers have been observed targeting TP-Link and ZTE router vulnerabilities as well, Akamai says. The threat actor behind the recently observed attacks appears not to have used vibe coding to build their payload. “Mirai malware campaigns continue to plague the industry, with much of the original source code continuing to be reused by various threat actors, both skilled and unskilled. The low barrier of entry and potential financial benefits are some of the incentives that may entice individuals to enter the botnet space and become a cyberthreat actor,” Akamai notes. Related: Evasive Masjesu DDoS Botnet Targets IoT Devices Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: 174 Vulnerabilities Targeted by RondoDox Botnet Related: Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Progress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMasterOrganizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities$290 Million Kelp DAO Crypto Heist Blamed on North KoreaBritish Scattered Spider Hacker Pleads Guilty in the USHackers Abuse QEMU for Defense EvasionHalf of the 6 Million Internet-Facing FTP Servers Lack EncryptionHackers Fail to Exploit Flaw in Discontinued TP-Link RoutersTycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks Latest News Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM DataClaude Mythos Finds 271 Firefox VulnerabilitiesNorth Korean Hackers Use AppleScript, ClickFix in Fresh macOS AttacksGoogle Antigravity in Crosshairs of Security Researchers, CybercriminalsOracle Patches 450 Vulnerabilities With April 2026 CPUThird US Security Expert Admits Helping Ransomware GangDozens of Malicious Crypto Apps Land in Apple App StoreUnsecured Perforce Servers Expose Sensitive Data From Major Orgs Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveAnti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors.ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer.Thomas Bain has been appointed Chief Marketing Officer at Silent Push.More People On The MoveExpert Insights Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2025-29635
• malware — Mirai

Entities