Newly Discovered Botnet ‘Ballista’ Targets Unpatched TP-Link Archer Routers

A recently identified botnet is actively exploiting vulnerabilities in TP-Link Archer home routers, potentially expanding its reach across various industries. Cybersecurity researchers at Cato Networks have linked this new botnet, dubbed Ballista, to a threat actor believed to be based in Italy.

Botnet Propagation and Exploited Vulnerability

Ballista spreads by exploiting a firmware vulnerability tracked as CVE-2023-1389, allowing it to automate infection across unpatched TP-Link devices. The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that this vulnerability is actively being exploited and previously mandated that U.S. civilian agencies patch affected devices.

The vulnerability primarily affects TP-Link AX21 (AX1800) routers, a model used by both consumers and businesses.

“We suspect we caught this campaign in its early stages. We saw it evolving, as within a short timeframe, the threat actor changed the initial dropper to allow stealthier connections to the C2 server through the Tor network,” said Matan Mittelman, Threat Prevention Team Leader at Cato Networks.

Italian Ties and Advanced Malware Capabilities

Researchers have moderate confidence that the hacker is based in Italy, citing:

• The command-and-control (C2) server’s IP address location.
• Italian-language strings embedded in the malware code.

Unlike many traditional botnets designed primarily for DDoS-for-hire operations, Ballista’s malware allows arbitrary command execution, suggesting that the attacker may have broader objectives.

Cato Networks first detected the campaign on January 10, observing continued access attempts through February 17. Researchers also noted that the malware’s code is structured in a way that new capabilities can be added to future versions, allowing for more sophisticated cyber operations.

Industries and Countries Affected

According to Cato Networks, Ballista has primarily targeted manufacturing, healthcare, services, and technology sectors in:

• United States
• Australia
• China
• Mexico

A search on Censys, a cybersecurity monitoring platform, revealed over 6,000 vulnerable TP-Link devices exposed to the internet.

Advanced Malware Techniques and Evasion Tactics

Once installed on a compromised router, Ballista:

• Takes full control of the device.
• Reads system configuration files for intelligence gathering.
• Establishes encrypted links to evade detection.
• Attempts to spread automatically by exploiting CVE-2023-1389 on other routers.

Cato Networks also discovered evidence of data exfiltration tools deployed by the threat actor, raising concerns that Ballista may be used for espionage or intelligence gathering.

Although the IP address linked to the hacker is no longer responsive, researchers have identified a new variant of the malware uploaded to GitHub, indicating ongoing development and adaptation.

“This suggests an increase in the sophistication level of the campaign by the threat actor. While this malware sample shares similarities with other botnets, it remains distinct from widely used botnets such as Mirai and Mozi,” Cato Networks stated.

The Growing IoT Security Problem

Cybersecurity experts emphasize that routers remain a prime target for hackers due to their:

• Weak passwords.
• Lack of regular firmware updates.
• Absence of automated security patching.

“Over the years, major IoT botnets like Mirai and Mozi have proven how easily routers can be exploited, and threat actors have taken note,” Mittelman explained. “Two key issues have played in their favor: users rarely deploy new firmware updates, and router vendors often deprioritize security.”

U.S. Government Concerns Over TP-Link Devices

In recent months, U.S. officials have flagged TP-Link routers as frequent targets for state-sponsored hackers, particularly from China. These devices have been implicated in cyberattacks on telecommunications networks and critical infrastructure.

For years, threat actors have exploited vulnerabilities in TP-Link routers, using them for:

• Hiding attack traffic.
• Building botnets to launch DDoS attacks.
• Acting as entry points for broader cyber operations.

The Wall Street Journal reported in December 2023 that U.S. agencies have considered banning TP-Link routers due to ongoing security concerns.

Conclusion

With the Ballista botnet still active and evolving, unpatched TP-Link routers remain at risk. Cybersecurity experts urge users and organizations to apply firmware updates immediately and implement network security best practices to prevent exploitation. The full scope of Ballista’s objectives remains unclear, but its increasing sophistication signals a growing threat to IoT security worldwide.

---

---

Help us bring real change! Corporate lobbying has corrupted our system for too long, and it’s time to take action. Please sign and share this petition—your support is crucial in restoring accountability to our government. Every signature counts! Thank you!

---

---

https://www.ipetitions.com/petition/restore-our-republic-end-lobbying

---

---

---

Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!

https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a

---