# D-Link Router Vulnerabilities Remain Under Attack by Botnets

FortiGuard Labs observed a spike in the activity of two different botnets - Ficora and Capsaicin - in October and November 2024. These botnets typically spread through vulnerabilities in D-Link devices, allowing attackers to execute malicious commands remotely.

# Impact Level

* **Affected Devices:**
    
    * D-Link DIR-645 RevAx wired/wireless routers with firmware 1.04b12 and earlier
        
    * D-Link DIR-806 devices. D-Link GO-RT-AC750 GORTAC750\_revA\_v101b03 and GO-RT-AC750\_revB\_FWv200b02
        
    * D-Link DIR-845L routers v1.01KRb03 and earlier
        
* **Related CVEs:**
    
    * CVE-2015-2051
        
    * CVE-2019-10891
        
    * CVE-2022-37056
        
    * CVE-2024-33112
        
* **Affected Users:** Any organization
    
* **Impact Level:** Attackers can gain control of remote systems
    
* **Severity:** High
    

When a device is successfully exploited, attackers leverage weaknesses in the D-Link management interface (HNAP) to execute malicious commands through GetDeviceSettings.

The botnets can steal data and execute shell scripts. The attackers' goal seems to be using the devices for distributed denial-of-service (DDoS) attacks.

The Ficora botnet primarily targets the Japanese and U.S. markets. Meanwhile, Capsaicin appears to mainly target devices in East Asian countries and has increased its activity for two days, starting from October 21.

![Figure 1: IPS Telemetry.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1735009795653/fig01-dlink-botnet.jpeg align="left")

*Figure 1. IPS attack metrics*

# Ficora Botnet

Ficora is a newer variant of the Mirai botnet, designed to exploit specific vulnerabilities in D-Link devices.

![Figure 2: “FICORA” Telemetry.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_1373255428.img.jpeg/1735009843882/fig02-dlink-botnet.jpeg align="left")

*Figure 2. Ficora botnet activity range*

After gaining initial access to D-Link devices, Ficora uses a shell script named 'multi' to download and execute its payload through various methods such as wget, curl, ftpget, and tftp, then deletes itself from the victim's system.

![Figure 4: Malicious “FICORA” command exploiting a D-Link vulnerability.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_159819884.img.jpeg/1735009943886/fig04-dlink-botnet.jpeg align="left")

*Figure 3. Malicious command exploiting a D-Link vulnerability to download “FICORA” malware*

This malware uses brute-force methods with predefined username and password lists to infect multiple Linux-based devices, supporting various hardware architectures.

![Figure 11: Hard-coded username list.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_1529966633.img.jpeg/1735010425916/fig11-a-dlink-botnet.jpeg align="left")

*Figure 4. Predefined username list*

![Figure 12: Hard-coded password list.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_596524644_copy.img.jpeg/1735010601955/fig12-a-dlink-botnet.jpeg align="left")

*Figure 5. Predefined password list*

Regarding DDoS attack capabilities, it supports UDP flooding, TCP flooding, and DNS amplification, diversifying attack methods to counter defense systems.

# Capsaicin Botnet

Capsaicin is a variant of the Kaiten botnet and is believed to be malware developed by the Keksec group, known for the “EnemyBot” malware and many other malware families targeting Linux devices. Fortinet discovered Capsaicin in a series of attacks from October 21 to 22, primarily targeting East Asian countries.

The infection occurs through a download script (“[bins.sh](http://bins.sh)”), which downloads binary files prefixed with 'yakuza' for different hardware architectures, including arm, mips, sparc, and x86.

![Figure 16: Malicious “CAPSAICIN” command targeting a D-Link Vulnerability.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_596524644_copy_722261825.img.jpeg/1735010988679/fig15-dlink-botnet.jpeg align="left")

*Figure 6. Malicious command exploiting a D-Link vulnerability to download “CAPSAICIN” malware*

Additionally, this malware actively searches for other botnets operating on the same server and disables them.

Besides DDoS capabilities similar to Ficora, Capsaicin can also collect server information and transmit it to a command and control (C2) server for monitoring.

![Figure 24: C2 commands.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_568572193.img.jpeg/1735012099276/fig24a-dlink-botnet.jpeg align="left")

*Figure 7. List of commands for C2 execution*

![Figure 25: DDoS attack commands.](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities/_jcr_content/root/responsivegrid/table_content/par/image_485195342.img.jpeg/1735012204055/fig25a-dlink-botnet.jpeg align="left")

*Figure 8. List of commands for DDoS execution*

# List of IOCs related to FICORA and CAPSAICIN malware

## URLs

### FICORA

| hxxp://103\[.\]149\[.\]87\[.\]69/multi |
| --- |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.arc |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.arm |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.arm5 |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.arm6 |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.arm7 |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.m68k |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.mips |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.mipsel |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.powerpc |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.sh4 |
| hxxp://103\[.\]149\[.\]87\[.\]69/la.bot.sparc |

### CAPSAICIN

| hxxp://87\[.\]11\[.\]174\[.\]141/bins.sh |
| --- |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.yak.sh |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.arm5 |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.arm6 |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.arm7 |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.i586 |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.i686 |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.m68k |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.mips |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.mipsel |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.ppc |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.sparc |
| hxxp://pirati\[.\]abuser\[.\]eu/yakuza.x86 |
| hxxp://87\[.\]10\[.\]220\[.\]221/bins.sh |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.sh |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.arm4 |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.arm5 |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.arm6 |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.arm7 |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.i586 |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.i686 |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.m68k |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.mips |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.mipsel |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.ppc |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.sparc |
| hxxp://87\[.\]10\[.\]220\[.\]221/yakuza.x86 |

## Hosts

| 103\[.\]149\[.\]87\[.\]69 |
| --- |
| ru\[.\]coziest\[.\]lol |
| f\[.\]codingdrunk\[.\]cc |
| www\[.\]codingdrunk\[.\]in |
| eighteen\[.\]pirate |
| nineteen\[.\]libre |
| 75cents\[.\]libre |
| 2joints\[.\]libre |
| fortyfivehundred\[.\]dyn |
| 21savage\[.\]dyn |
| imaverygoodbadboy\[.\]libre |
| le\[.\]codingdrunk\[.\]in |
| 87\[.\]11\[.\]174\[.\]141 |
| pirati\[.\]abuser\[.\]eu |
| 87\[.\]10\[.\]220\[.\]221 |
| 45\[.\]86\[.\]86\[.\]60 |
| 194\[.\]110\[.\]247\[.\]46 |

## Files

### Downloader

| **Value** | **Type** |
| --- | --- |
| f71dc58cc969e79cb0fdfe5163fbb9ed4fee5e13cc9407a11d231601ee4c6e23 | SHA-256 |
| ea83411bd7b6e5a7364f7b8b9018f0f17f7084aeb58a47736dd80c99cfeac7f1 | SHA-256 |
| 48a04c7c33a787ef72f1a61aec9fad87d6bd9c49542f52af7e029ac83475f45d | SHA-256 |
| 18c92006951f93a77df14eca6430f32389080838d97c9e47364bf82f6c21a907 | SHA-256 |

### FICORA

| **Value** | **Type** |
| --- | --- |
| 9b161a32d89f9b19d40cd4c21d436c1daf208b5d159ffe1df7ad5fd1a57610e5 | SHA-256 |
| faeea9d5091384195e87caae9dd88010c9a2b3b2c88ae9cac8d79fd94f250e9f | SHA-256 |
| 10d7aedc963ea77302b967aad100d7dd90d95abcdb099c5a0a2df309c52c32b8 | SHA-256 |
| 7f6912de8bef9ced5b9018401452278570b4264bb1e935292575f2c3a0616ec4 | SHA-256 |
| a06fd0b8936f5b2370db5f7ec933d53bd8a1bf5042cdc5c052390d1ecc7c0e07 | SHA-256 |
| 764a03bf28f9eec50a1bd994308e977a64201fbe5d41337bdcc942c74861bcd3 | SHA-256 |
| df176fb8cfbc7512c77673f862e73833641ebb0d43213492c168f99302dcd5e3 | SHA-256 |
| ac2df391ede03df27bcf238077d2dddcde24cd86f16202c5c51ecd31b7596a68 | SHA-256 |
| ca3f6dce945ccad5a50ea01262b2d42171f893632fc5c5b8ce4499990e978e5b | SHA-256 |
| afee245b6f999f6b9d0dd997436df5f2abfb3c8d2a8811ff57e3c21637207d62 | SHA-256 |
| ec508df7cb142a639b0c33f710d5e49c29a5a578521b6306bee28012aadde4a8 | SHA-256 |

### CAPSAICIN

| **Value** | **Type** |
| --- | --- |
| 8349ba17f028b6a17aaa09cd17f1107409611a0734e06e6047ccc33e8ff669b0 | SHA-256 |
| b3ad8409d82500e790e6599337abe4d6edf5bd4c6737f8357d19edd82c88b064 | SHA-256 |
| ec87dc841af77ec2987f3e8ae316143218e9557e281ca13fb954536aa9f9caf1 | SHA-256 |
| 784c9711eadceb7fedf022b7d7f00cff7a75d05c18ff726e257602e3a3ccccc1 | SHA-256 |
| bde6ef047e0880ac7ef02e56eb87d5bc39116e98ef97a5b1960e9a55cea5082b | SHA-256 |
| c7be8d1b8948e1cb095d46376ced64367718ed2d9270c2fc99c7052a9d1ffed7 | SHA-256 |
| 4600703535e35b464f0198a1fa95e3668a0c956ab68ce7b719c28031d69b86ff | SHA-256 |
| 6e3ef9404817e168c974000205b27723bc93abd7fbf0581c16bb5d2e1c5c6e4a | SHA-256 |
| 32e66b87f47245a892b102b7141d3845540b270c278e221f502807758a4e5dee | SHA-256 |
| 540c00e6c0b53332128b605b0d5e0926db0560a541bb13448d094764844763df | SHA-256 |
| b74dbd02b7ebb51700f3c5900283e46570fe497f9b415d25a029623118073519 | SHA-256 |
| 148f6b990fc1f1903287cd5c20276664b332dd3ba8d58f2bf8c26334c93c3af5 | SHA-256 |
| 464e2f1faab2a40db44f118f7c3d1f9b300297fe6ced83fabe87563fc82efe95 | SHA-256 |
| b699cd64b9895cdcc325d7dd96c9eca623d3ec0247d20f39323547132c8fa63b | SHA-256 |
| 1007f5613a91a5d4170f28e24bfa704c8a63d95a2b4d033ff2bff7e2fe3dcffe | SHA-256 |
| 7a815d4ca3771de8a71cde2bdacf951bf48ea5854eb0a2af5db7d13ad51c44ab | SHA-256 |
| d6a2a22000d68d79caeae482d8cf092c2d84d55dccee05e179a961c72f77b1ba | SHA-256 |
| 7ab36a93f009058e60c8a45b900c1c7ae38c96005a43a39e45be9dc7af9d6da8 | SHA-256 |
| 803abfe19cdc6c0c41acfeb210a2361cab96d5926b2c43e5eb3b589a6ed189ad | SHA-256 |
| 7b29053306f194ca75021952f97f894d8eae6d2e1d02939df37b62d3845bfdb7 | SHA-256 |
| 59704cf55b9fa439d6f7a36821a50178e9d73ddc5407ff340460c054d7defc54 | SHA-256 |
| aaa49b7b4f1e71623c42bc77bb7aa40534bcb7312da511b041799bf0e1a63ee7 | SHA-256 |
| 1ca1d5a53c4379c3015c74af2b18c1d9285ac1a48d515f9b7827e4f900a61bde | SHA-256 |

# Recommendations

FPT Threat Intelligence recommends organizations and individuals take several measures to prevent this campaign:

* **Update device firmware**: Ensure that routers and IoT devices are always running the latest firmware version to patch known security vulnerabilities.
    
* **Replace old devices**: If a device has reached the end of its life cycle and no longer receives security updates, replace it with a new model.
    
* **Change default passwords**: Use strong and unique admin passwords, and disable remote access interfaces if not necessary.
    

# References

* [Malware botnets exploit outdated D-Link routers in recent attacks](https://www.bleepingcomputer.com/news/security/malware-botnets-exploit-outdated-d-link-routers-in-recent-attacks/)
    
* [Botnets Continue to Target Aging D-Link Vulnerabilities](https://www.fortinet.com/blog/threat-research/botnets-continue-to-target-aging-d-link-vulnerabilities)