Cato Networks has discovered a new IoT botnet that targets TP-Link Archer routers through the exploitation of a vulnerability discovered two years ago. 

The botnet has been linked with moderate confidence — based on an IP address and strings found in malware binaries — to an unnamed Italian threat actor, which is why Cato has called it Ballista, the name of a missile launcher used by the Roman empire.

Cato first saw Ballista on January 10 and the most recent activity was observed in mid-February, but the security firm believes the botnet is still active.

Ballista has targeted organizations in the US, Australia, China and Mexico, including in the manufacturing, healthcare, services, and technology sectors. 

The botnet targets TP-Link Archer routers by exploiting a vulnerability tracked as CVE-2023-1389. This flaw was discovered at a Pwn2Own hacker competition in late 2022 and its exploitation was first reported in May 2023. Later it was added to the arsenal of several botnets.

Ballista exploits CVE-2023-1389 to spread its malware to vulnerable devices on the internet. A Censys search shows more than 6,000 internet-exposed devices that could be vulnerable to attacks.

In the attacks observed by Cato, the initial payload is a dropper that downloads malware onto the compromised router.

“Once executed, the malware sets up a TLS encrypted command and control (C2) channel on port 82, which is used to fully control the compromised device,” Cato explained. 

The malware supports commands for removing itself from the device to avoid detection, reading configuration files, spreading to other devices on the internet, running shell commands on the compromised device, and launching DDoS attacks.  

During Cato’s analysis of Ballista, the company observed the attackers replacing a hardcoded IP address from which the malware was downloaded with Tor domains, possibly in an effort to become stealthier. 

Related: Edimax Says No Patches Coming for Zero-Day Exploited by Botnets

Related: BadBox Botnet Powered by 1 Million Android Devices Disrupted

Related: New Eleven11bot DDoS Botnet Powered by 80,000 Hacked Devices