Emerging Threat: AndoryuBot Exploits Ruckus Wireless Vulnerability
CVE-2023-25717 affecting all versions of Ruckus Wireless Management panels up to 10.4
A new botnet called AndoryuBot is exploiting a critical vulnerability in the Ruckus Wireless Admin panel, infecting unpatched Wi-Fi access points for use in DDoS attacks.
In a recent alarming development, a new botnet named AndoryuBot has emerged, targeting a critical vulnerability (CVE-2023-25717) found in Ruckus Wireless administration software. This botnet has the potential to cause severe security breaches and remote code execution on affected devices.
FortiGuard Labs has recently observed a spike in our detection for the Ruckus Wireless Admin RCE vulnerability (CVE-2023-25717).
Researchers at Fortiguard Labs highlighted that Ruckus Wireless, a popular provider of wireless networking equipment, has become the focus of this sophisticated attack. The vulnerability allows threat actors to gain unauthorised access to the administration interface of Ruckus Wireless devices, thereby compromising the entire network infrastructure.
AndoryuBot leverages this vulnerability to infiltrate the affected devices and establish a botnet network, which is a collection of compromised devices under the control of a single attacker. Once the botnet is established, it can be utilized for various malicious activities, such as launching distributed denial-of-service (DDoS) attacks, spreading malware, or stealing sensitive data.
Organisations using Ruckus Wireless devices should take immediate action to safeguard their networks. The first step is to ensure all affected devices are updated with the latest firmware patch provided by Ruckus Wireless to address the vulnerability. Additionally, implementing proper security measures, such as network segmentation, strong access controls, and continuous monitoring, can help mitigate the risk of a successful attack.
The emergence of AndoryuBot serves as a stark reminder of the ever-evolving threat landscape and the critical need for organisations to remain vigilant in securing their network infrastructure. By staying informed about the latest vulnerabilities and promptly applying patches, companies can minimize their exposure to potential attacks and protect their valuable assets from falling victim to botnets like AndoryuBot.
The full article, available here, provides more detailed information on the AndoryuBot campaign and offers additional guidance on protecting networks from this threat.
How could qomodo have helped?
Recognising that not all device have the resource availability to run complex security analysis and response actions, qomodo’s micro agent is specifically designed to utilise functionality already built into most Internet of Things (IoT) and Industrial IoT products.
Real-time network monitoring: qomodo is able to monitor network traffic in real-time, swiftly detecting any suspicious activities associated with the Andoryubot botnet campaign. It analyzes incoming and outgoing packets, identifying malicious communication patterns or exploit attempts.
Intrusion detection and prevention: With qomodo, network packets and syscall actions are actively scanned to identify any attempts to exploit the CVE-2023-25717 vulnerability exploited by Andoryubot. It blocks malicious activity, preventing unauthorised access and compromising devices.
Behavioral analysis: qomodo analyses network traffic and device behavior, comparing it against known attack patterns and anomalies seen across other devices using qomodo. It proactively blocks any malicious activities associated with Andoryubot, even if the botnet employs previously unseen tactics.
Zero-day vulnerability protection: qomodo quickly adapts to detect and mitigate new or unknown vulnerabilities in the Ruckus Wireless Admin interface or associated components. This ensures immediate protection against emerging attack vectors. We are able to roll down ‘hot fix’ behavioural profiles to mitigate the risk, while waiting for the patch from the device vendor.
Rapid response and mitigation: Operating at the kernel level, qomodo can provide rapid response capabilities. It swiftly detects Andoryubot-related activities, blocks malicious traffic, and promptly alerts security administrators, enabling them to take immediate action and neutralize the threat.
