New Ballista Botnet spreads using TP-Link flaw. Is it an Italian job?
Tags
country: Australia China Italy Mexico
maec-delivery-vectors: Watering Hole
attack-pattern: Data Botnet - T1583.005 Botnet - T1584.005 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Unix Shell - T1059.004 Exploit Public-Facing Application - T1190
Show in Graph
Common Information
Type Value
UUID 2a019a74-77ea-4ed3-af50-9c7a56e5d3cf
Fingerprint a5ada30c8d1399c1
Analysis status DONE
Considered CTI value 2
Text language
Published March 12, 2025, 9:51 a.m.
Added to db March 12, 2025, 11:13 a.m.
Last updated March 20, 2025, 9:41 p.m.
Headline UNKNOWN
Title New Ballista Botnet spreads using TP-Link flaw. Is it an Italian job?
Detected Hints/Tags/Attributes 49/3/5
Source URLs
Redirection Url
Details Source https://securityaffairs.com/175278/malware/ballista-botnet-exploits-unpatched-tp-link-flaw.html
URL Provider
Details Provider Source level domain
Details securityaffairs.com securityaffairs.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 486 ✔ Security Affairs https://securityaffairs.com/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 61 
cve-2023-1389
Details Domain 1 
dropbpb.sh
Details IPv4 3 
2.237.57.70
Details MITRE ATT&CK Techniques 652 
T1190
Details MITRE ATT&CK Techniques 112 
T1059.004