Security experts recommend organizations immediately audit Telnet exposure on VOIP-enabled systems, rotate or disable default credentials on edge devices, and implement dynamic IP blocking to defend against these coordinated attacks. All traffic from these compromised systems was Telnet-based, exhibiting characteristics consistent with botnet participation, including “Telnet Bruteforcer,” “Generic IoT Default Password Attempt,” and “Mirai” tags. The compromised devices shared common characteristics: Telnet login attempts using weak or default credentials, high session volumes, and scanning behavior aligned with known Mirai botnet variants. Using AI-powered analysis through their Model Context Protocol (MCP) server, researchers identified a unique network fingerprint: JA4t signature 5840_2-4-8-1-3_1460_1, which represented 90% of the malicious traffic. When GreyNoise researchers briefly mentioned the activity on social media, traffic from the New Mexico utility completely ceased, only to spike again shortly afterward, suggesting attackers actively monitor security community discussions. The discovery began when analysts noticed an unusual cluster of malicious IP addresses concentrated in rural New Mexico, leading to the identification of approximately 500 compromised devices worldwide. Some Cambium routers in the affected infrastructure may still be running firmware versions impacted by a remote code execution (RCE) vulnerability disclosed in 2017, though researchers could not confirm exploitation of that specific CVE. The analysis confirmed that many affected systems were VoIP-enabled devices, with hardware from Cambium Networks likely involved in portions of the campaign. These devices typically run older Linux-based firmware with Telnet services exposed by default, making them attractive targets for threat actors. Traced ~90 compromised devices in rural New Mexico to 500+ infected systems worldwide. This signature indicates similar hardware configurations across compromised hosts, suggesting coordinated targeting of specific device types.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 26 Jul 2025 06:00:18 +0000