{
  "name": "Gayfemboy: A Botnet Deliver Through a Four-Faith Industrial Router 0-day Exploit.",
  "slug": "gayfemboy-a-botnet-deliver-through-a-four-faith-industrial-router-0-day-exploit",
  "description": "The Gayfemboy botnet, discovered in February 2024, has evolved from a simple Mirai derivative into a sophisticated large-scale botnet. It exploits a 0-day vulnerability in Four-Faith industrial routers and unknown vulnerabilities in other devices to spread. With over 15,000 daily active nodes across 40 grouping categories, it targets multiple countries and industries. The botnet's capabilities include self-updating, scanning, and various DDoS attack methods. It has shown aggressive behavior, retaliating against attempts to analyze it. The botnet's evolution demonstrates the persistent threat of DDoS attacks and the need for comprehensive defense strategies.",
  "published": "2025-01-08T08:45:41+00:00",
  "created_at": "2025-01-08T08:45:41+00:00",
  "modified_at": "2025-01-08T09:14:23+00:00",
  "created_at_opencti": "2025-01-08T08:45:41+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "0-day",
    "2025-01-08",
    "CVE-2024-12856",
    "botnet",
    "ddos",
    "four-faith",
    "gayfemboy",
    "industrial-router"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "209.141.57.222"
      },
      {
        "id": "",
        "name": "209.141.55.38"
      },
      {
        "id": "",
        "name": "209.141.35.56"
      },
      {
        "id": "",
        "name": "203.23.159.152"
      },
      {
        "id": "",
        "name": "152.32.237.129"
      },
      {
        "id": "",
        "name": "124.71.235.245"
      },
      {
        "id": "",
        "name": "123.249.94.157"
      },
      {
        "id": "",
        "name": "123.249.99.231"
      },
      {
        "id": "",
        "name": "123.249.91.159"
      },
      {
        "id": "",
        "name": "123.249.90.23"
      },
      {
        "id": "",
        "name": "123.249.82.229"
      },
      {
        "id": "",
        "name": "123.249.87.110"
      },
      {
        "id": "",
        "name": "123.249.82.162"
      },
      {
        "id": "",
        "name": "123.249.68.177"
      },
      {
        "id": "",
        "name": "123.249.64.207"
      },
      {
        "id": "",
        "name": "123.249.126.147"
      },
      {
        "id": "",
        "name": "123.249.116.81"
      },
      {
        "id": "",
        "name": "123.249.116.30"
      },
      {
        "id": "",
        "name": "123.249.109.227"
      },
      {
        "id": "",
        "name": "123.249.103.79"
      },
      {
        "id": "",
        "name": "108.233.83.51"
      },
      {
        "id": "",
        "name": "101.43.141.112"
      },
      {
        "id": "",
        "name": "1.13.102.222"
      },
      {
        "id": "",
        "name": "45.145.41.175"
      },
      {
        "id": "",
        "name": "123.249.111.22"
      },
      {
        "id": "",
        "name": "107.189.28.60"
      },
      {
        "id": "",
        "name": "101.42.158.190"
      },
      {
        "id": "",
        "name": "209.141.32.148"
      },
      {
        "id": "",
        "name": "185.16.39.37"
      },
      {
        "id": "",
        "name": "123.249.90.104"
      },
      {
        "id": "",
        "name": "178.211.139.105"
      },
      {
        "id": "",
        "name": "70.36.99.15"
      },
      {
        "id": "",
        "name": "95.214.54.53"
      },
      {
        "id": "",
        "name": "198.98.54.234"
      },
      {
        "id": "",
        "name": "178.211.139.196"
      },
      {
        "id": "",
        "name": "5.181.188.158"
      },
      {
        "id": "",
        "name": "193.34.214.123"
      },
      {
        "id": "",
        "name": "77.90.22.35"
      },
      {
        "id": "",
        "name": "178.211.139.241"
      },
      {
        "id": "",
        "name": "45.95.147.211"
      },
      {
        "id": "",
        "name": "37.114.63.100"
      },
      {
        "id": "",
        "name": "193.42.12.166"
      },
      {
        "id": "",
        "name": "209.141.51.21"
      },
      {
        "id": "",
        "name": "45.148.10.230"
      },
      {
        "id": "",
        "name": "77.90.22.10"
      },
      {
        "id": "",
        "name": "94.156.10.164"
      },
      {
        "id": "",
        "name": "94.156.10.163"
      },
      {
        "id": "",
        "name": "176.97.210.250"
      },
      {
        "id": "",
        "name": "45.142.122.187"
      },
      {
        "id": "",
        "name": "45.142.182.126"
      },
      {
        "id": "",
        "name": "209.141.32.195"
      },
      {
        "id": "",
        "name": "45.128.232.200"
      },
      {
        "id": "",
        "name": "193.32.162.34"
      },
      {
        "id": "",
        "name": "198.98.51.91"
      },
      {
        "id": "",
        "name": "meowware.ddns.net"
      },
      {
        "id": "",
        "name": "itns.net"
      }
    ],
    "malware": [
      {
        "id": "04b13079-f005-41f8-9869-ba0495a2879b",
        "name": "Gayfemboy",
        "slug": "gayfemboy"
      },
      {
        "id": "5fdcf97f-0489-477b-a5df-c662e5fc5579",
        "name": "Mirai",
        "slug": "mirai"
      }
    ],
    "intrusion_sets": [
      {
        "id": "d8ff571f-9014-4932-a54d-f54a39fee764",
        "name": "Gayfemboy",
        "slug": "gayfemboy"
      }
    ],
    "attack_patterns": [
      {
        "id": "5e3b3612-8bf8-46e1-943e-b4c1524bef11",
        "name": "T1587"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "53b3b18c-d0d0-4bf6-bc6b-2c0ab9180deb",
        "name": "T1070"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "d570881a-1f73-41ca-ad6c-fc29256c76f9",
        "name": "T1595"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2013-7471"
      },
      {
        "id": "",
        "name": "CVE-2024-12856"
      },
      {
        "id": "",
        "name": "CVE-2024-8957"
      },
      {
        "id": "",
        "name": "CVE-2024-8956"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Iran, Islamic Republic of"
      },
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Russian Federation"
      }
    ]
  },
  "external_refs": [
    "https://blog.xlab.qianxin.com/gayfemboy-en",
    "https://otx.alienvault.com/pulse/677e4945acd538e9f4a8577a"
  ]
}