Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A threat actor nicknamed ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots. The actor targets more than 50 brands of SOHO routers, SSL VPNs, DVRs, and BMC controllers, possibly to collect exploited vulnerabilities. The infection chain involves exploiting CVE-2023-20118 to deploy a script called NetGhost, which redirects incoming traffic to the attacker's infrastructure. The compromised devices, mostly end-of-life, are used to create a distributed honeypot-like network across Asia. The actor, likely of Chinese-speaking origin, may be attempting to observe exploitation attempts and collect non-public or zero-day exploits. The infrastructure uses servers in Malaysia, and the campaign has been ongoing since March 2025.

The ViciousTrap campaign represents a sophisticated threat actor operation targeting over 5,500 edge devices, including SOHO routers, SSL VPNs, DVRs, and BMC controllers from more than 50 different brands. The actor exploits vulnerabilities such as CVE-2023-20118 to deploy a malicious script named NetGhost. This script redirects incoming traffic from the compromised devices to attacker-controlled infrastructure, effectively transforming these devices into distributed honeypots. These honeypots serve as traps to lure other attackers or malware, allowing ViciousTrap to observe exploitation attempts, collect data on exploited vulnerabilities, and potentially gather zero-day or non-public exploits. The majority of the compromised devices are end-of-life, which likely lack vendor support and security updates, making them easier targets. The campaign infrastructure is based in Malaysia and has been active since March 2025. The threat actor is believed to be of Chinese-speaking origin. The attack chain involves multiple tactics and techniques, including reconnaissance, exploitation, command and control, and lateral movement, as indicated by the associated MITRE ATT&CK tags such as T1133 (External Remote Services), T1190 (Exploit Public-Facing Application), and T1090 (Proxy). The use of compromised devices as honeypots is a novel approach, turning victim devices into tools for further intelligence gathering rather than direct exploitation or disruption. This method allows the actor to monitor attacker behaviors and potentially discover new vulnerabilities or attack vectors in real time.

Detailed information about ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.. Get real-time updates, technical details, and

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse. - Live Threat Intelligence - Threat Radar | OffSeq.com

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

Black Basta, a ransomware-as-a-service group, has been using an automated brute forcing framework called BRUTED to target edge network devices since 2023. The framework performs internet scanning and credential stuffing against firewalls and VPN solutions in corporate networks. Black Basta prioritizes high-impact industries, particularly the Business Services sector, to amplify operational disruptions. The group's internal communications were leaked, exposing their infrastructure and operational details. BRUTED targets various remote-access and VPN solutions, using proxy rotation, credential generation, and distributed execution to scale attacks. Black Basta exploits vulnerabilities in edge devices for initial access, then targets ESXi hypervisors to encrypt file systems and disrupt virtual machines, maximizing operational impact and ransom leverage.

Black Basta is a ransomware-as-a-service (RaaS) group that has been actively employing an automated brute forcing framework named BRUTED since 2023 to compromise edge network devices. BRUTED automates internet-wide scanning and credential stuffing attacks targeting firewalls and VPN solutions commonly deployed in corporate networks. The framework uses proxy rotation, credential generation, and distributed execution to scale brute force attacks efficiently while evading detection. Black Basta focuses on high-impact industries, particularly the Business Services sector, to maximize operational disruption and increase ransom leverage. After gaining initial access through compromised edge devices, the group escalates privileges and targets ESXi hypervisors to encrypt file systems and disrupt virtual machines, amplifying the impact on organizational operations. The leak of Black Basta's internal communications has exposed their infrastructure and operational methods, providing valuable insight into their attack lifecycle. Indicators of compromise include multiple suspicious domains used for command and control or infrastructure purposes. This threat exploits weak or reused credentials on remote access and VPN devices rather than specific software vulnerabilities, and no known exploits beyond brute forcing have been reported. The attack vector centers on credential-based intrusion, leveraging poor credential hygiene and insufficient monitoring of edge devices.

Detailed information about Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices. Get real-time updates, techn

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'edge devices'

Filter Threats

Threats Tagged 'edge devices'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility