New SOAP Attack Hits South African Home Routers

A huge wave of attacks is targeting home routers in South Africa for recruitment into a Hakai-based botnet.

A new malware campaign is attempting to build a bigger botnet, and its raising warning flags for its attack vector — and the location of the victims.
According to NetScout, IoT honeypots run by its ATLAS Security Engineering & Response Team (ASERT) saw, from April 22 to May 10, a 5,043% increase of exploit attempts that originated in Egypt and targeted consumer routers in South Africa. The attacks, with a payload that attempted to recruit the routers into a botnet using a Hakai DDoS bot variant, exploit (CVE-2014-8361) a remote command execution exploit in the Realtek SDK managed SOAP service.
According to Rich Hummel, threat research manager for NetScout ASERT, these consumer routers are almost never patched or updated, with many consumers having no idea that a management interface exists, or how to use it. And unfortunately, There are a lot of different factors here, and there are different layers, but its really on the consumer or owner of the devices to protect themselves against the threats, Hummel says.
Asked about a possible motivation for this attack, at this time, Hummel says that ASERT can only speculate about any deep motivation. The most logical answer, though, is that someone simply decided to spin up a new botnet.
This is a target of opportunity, Hummel says. These attacks are automated, so it could be that something was seen and an automated attack was launched. As for what was seen, Hummel says that it could have been something as simple as a Shodan script looking for exposed devices with an automated attack script aimed at the results file.
Attack automation and malware as a service make botnet creation something thats available to just about anyone, Hummel says. It can be done on a Raspberry Pi.
For more, read
here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New SOAP Attack Hits South African Home Routers