Mirai Botnet Propagation and Exploitation of CVE-2025-24016
Essential information
- Published
- 23/10/2025 13:40
- Modified
- 23/10/2025 14:11
- Tags
- 2025-10-23 CVE-2025-24016 botnet mirai wazuh
- Related entities
- 1 vulnerabilities (cve), 40 observables, 13 techniques (mitre), 1 malware
Description
The Mirai botnet continues to spread as operators repurpose old source code and exploit newly published vulnerabilities. The CVE program, while beneficial, sometimes inadvertently highlights overlooked vulnerabilities. Researchers' attempts to educate through PoCs often lead to negative outcomes, emphasizing the importance of timely patching. CVE-2025-24016 affects active Wazuh servers running outdated versions, and patching to version 4.9.1 or later is highly recommended. The report includes IOCs, Snort rules, and Yara rules for two Mirai-based botnets, detailing their C2 infrastructure, malicious domains, and file hashes.