ShadowV2 Casts a Shadow Over IoT Devices
A new Mirai variant called ShadowV2 has been observed spreading through IoT vulnerabilities during a global AWS disruption. The malware targeted multiple countries and industries worldwide, exploiting vulnerabilities in devices from vendors like DD-WRT, D-Link, Digiever, TBK, and TP-Link. ShadowV2 is designed for IoT devices and uses a XOR-encoded configuration to connect to a C2 server for receiving DDoS attack commands. The malware supports various attack methods, including UDP floods, TCP-based floods, and HTTP-level floods. This incident highlights the ongoing vulnerability of IoT devices and the need for timely firmware updates, robust security practices, and continuous threat monitoring.
Pulse ID: 6927ffd2068d6127f3387514
Pulse Link: https://otx.alienvault.com/pulse/6927ffd2068d6127f3387514
Pulse Author: AlienVault
Created: 2025-11-27 07:37:54
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AWS #CyberSecurity #DDoS #DoS #HTTP #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #TCP #UDP #Vulnerability #bot #AlienVault