Threats tagged 'netghost'

The ViciousTrap campaign involves a threat actor compromising over 5,500 edge devices, including SOHO routers, SSL VPNs, DVRs, and BMC controllers, primarily end-of-life models. The attacker exploits CVE-2023-20118 to deploy a script named NetGhost, which redirects incoming traffic to attacker-controlled infrastructure, effectively turning these devices into distributed honeypots. The campaign has been active since March 2025 and targets more than 50 device brands, mainly across Asia, with infrastructure hosted in Malaysia. The actor appears to be collecting exploitation attempts and possibly zero-day vulnerabilities by observing traffic through these compromised devices. The campaign is linked to a medium severity threat with known exploitation in the wild.

KEVEPSS 54%Report on CVE-2023-20118CampaignCisco#gobrat#soho routersGermany+9