{"id":128094,"date":"2025-12-01T01:45:44","date_gmt":"2025-11-30T20:15:44","guid":{"rendered":"https:\/\/www.techworm.net\/?p=128094"},"modified":"2025-12-01T01:45:44","modified_gmt":"2025-11-30T20:15:44","slug":"shadowv2-botnet-used-aws-outage","status":"publish","type":"post","link":"https:\/\/www.techworm.net\/2025\/12\/shadowv2-botnet-used-aws-outage.html","title":{"rendered":"ShadowV2 Botnet Used AWS Outage As A Quiet Test Run, Researchers Say"},"content":{"rendered":"

Security researchers at Fortinet\u2019s FortiGuard Labs have identified a new Mirai-based botnet called ShadowV2<\/strong> that quietly emerged during the major AWS outage in October, targeting vulnerable IoT devices worldwide and disappearing soon after the outage ended.<\/p>\n

According to the researchers, the botnet was active for roughly 15 hours, beginning shortly after AWS services began failing worldwide. While the outage itself wasn\u2019t caused by the malware, the unusual timing strongly suggests that the attackers used the global service disruption as cover to test their malware in the wild.<\/p>\n

Wide Range Of Vulnerabilities Exploited<\/strong><\/p>\n

The botnet spread by exploiting at least eight known vulnerabilities impacting popular IoT devices from vendors including D-Link, TP-Link, DD-WRT, DigiEver, and TBK. The flaws ranged from remote command execution to authentication bypass and affected routers, Wi-Fi access points, NAS devices, DVRs, and smart camera systems.<\/p>\n

Vulnerabilities exploited include:<\/p>\n

DD-WRT<\/strong>: CVE-2009-2765<\/em><\/p>\n

D-Link<\/strong>: CVE-2020-25506, CVE-2022-37055, CVE-2024-10914, CVE-2024-10915<\/em><\/p>\n

DigiEver<\/strong>: CVE-2023-52163<\/em><\/p>\n

TBK<\/strong>: CVE-2024-3721<\/em><\/p>\n

TP-Link<\/strong>: CVE-2024-53375<\/em>\u00a0<\/em><\/p>\n

The most concerning issues involve end-of-life NAS models (CVE-2024-10914 and CVE-2024-10915), which D-Link has confirmed it will not patch, leaving users permanently exposed unless they replace the hardware entirely.<\/p>\n

Further, TP-Link\u2019s flaw (CVE-2024-53375) has been addressed with a beta firmware update, while DigiEver and TBK vulnerabilities also remain active exploitation targets.\u00a0<\/strong><\/p>\n

Global Spread Across 28 Countries And Multiple Sectors<\/strong><\/p>\n

During its short activity window, ShadowV2 launched attacks from an IP address located at 198[.]199[.]72[.]27, attempting to compromise six continents. Affected regions include:<\/p>\n

Americas:<\/strong> U.S., Canada, Mexico, Brazil, Bolivia, Chile<\/p>\n

Europe:<\/strong> U.K., Netherlands, Belgium, France, Italy, Czechia, Austria, Croatia, Greece<\/p>\n

Africa:<\/strong> Morocco, Egypt, South Africa<\/p>\n

Asia:<\/strong> Turkey, Saudi Arabia, Russia, China, Japan, Taiwan, Thailand, Philippines<\/p>\n

Oceania:<\/strong> Australia<\/p>\n

Targeted industries included organizations across seven major sectors, such as technology, manufacturing, telecommunications, government, managed security service providers, education, and retail and hospitality. The widespread distribution indicates that the attackers were testing the botnet\u2019s ability to infect and communicate across diverse environments.<\/p>\n

How ShadowV2 Works<\/strong><\/p>\n

ShadowV2 identifies itself as \u201cShadowV2 Build v1.0.0 IoT Version\u201d, suggesting this is the botnet\u2019s first dedicated IoT variant. Fortinet notes that it is structurally similar to the classic Mirai variant LZRD, incorporating lightweight binaries and XOR-encoded configuration data to avoid detection.<\/p>\n

Infection Process:<\/strong><\/p>\n