Tuesday, May 13, 2025
HomeVulnerabilityHackers Launching Massive Cyber Attack Against 800,000 DrayTek Routers by Exploiting zero-day...

Hackers Launching Massive Cyber Attack Against 800,000 DrayTek Routers by Exploiting zero-day Vulnerability

Published on

SIEM as a Service

Follow Us on Google News

The new attack that being launched by cyber criminals against DrayTek Routers where they could  Exploiting zero-day Vulnerability to change DNS settings of routers.

Taiwan based DrayTek Provides broadband routers series serve any Ethernet-based Internet feeds for home and business networks which enables  WAN failover, load-balancing, Bandwidth Management, Firewall, VPN features are available in most models.

Most of the users are reporting that their DrayTek Router DNS settings changed but the Syslog show that no one signed on.

- Advertisement - Google News

Researcher believes that attacker possibly compromised the Router using brute force attack or they exploiting the zero-day vulnerability.

https://twitter.com/GossiTheDog/status/997437742295416832

Successfully compromised routers administration session has been hijacked by an attacker then DNS settings are being altered and redirected to an unknown server located at the Specific server. 38.134.121.95.

In this case, Some of the compromised users reported that they have already changed their default password even though their DNS setting being alternated.

DrayTek has confirmed that there is an issue with their routers So the attack was being targeted by exploiting the Zero-day.

https://twitter.com/GossiTheDog/status/997445209515536384

When we analyzed the shodan search and it reveals that there are more than 800,000 DrayTek devices currently running around the world and vulnerable to this new attack,

DrayTek released a security advisory for the its user to protect their router and it warned that, “We are in the process of releasing updated firmware which you should upgrade to as soon as it is available “
Check your DNS and DHCP settings on your router.   If you have a router supporting multiple LAN subnets, check settings for each subnet. 
Your DNS settings should be either blank, set to the correct DNS server addresses from your ISP or DNS server addresses of a server which you have deliberately set (e.g. Google 8.8.8.8). A known rogue DNS server is 38.134.121.95 – if you see that, your router has been changed.  

Along with this warning, DrayTek advised following the various instruction to protect the users from being compromised by new attacks against web-enabled devices.

Also, users should check whether DNS settings are being altered and they are in the process of producing and issuing new firmware and a user should install that as soon as possible.

Until then users can check the routers DNS settings on your router and correct them if changed. also, users need to disable the remote admin unless needed and recommend only using secured (TLS1.2) connections for web admin (for local and remote admin).

List of Updated Versions

  • Vigor120, version 3.8.8.2
  • Vigor122, version 3.8.8.2
  • Vigor130, version 3.8.8.2
  • VigorNIC 132, version 3.8.8.2
  • Vigor2120 Series, version 3.8.8.2
  • Vigor2132, version 3.8.8.2
  • Vigor2133, version 3.8.8.2
  • Vigor2760D, version 3.8.8.2
  • Vigor2762, version 3.8.8.2
  • Vigor2832, version 3.8.8.2
  • Vigor2860, version 3.8.8
  • Vigor2862, version 3.8.8.2
  • Vigor2862B, version 3.8.8.2
  • Vigor2912, version 3.8.8.2
  • Vigor2925, version 3.8.8.2
  • Vigor2926, version 3.8.8.2
  • Vigor2952, version 3.8.8.2
  • Vigor3220, version 3.8.8.2
  • VigorBX2000, version 3.8.8.2
  • VigorIPPBX2820, version 3.8.8.2
  • VigorIPPBX3510, version 3.8.8.2
  • Vigor2830nv2, version 3.8.8.2
  • Vigor2820, version 3.8.8.2
  • Vigor2710, version 3.8.8.2
  • Vigro2110, version 3.8.8.2
  • Vigro2830sb, version 3.8.8.2
  • Vigor2850, version 3.8.8.2
  • Vigor2920, version 3.8.8.2
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Microsoft Patch Tuesday May 2025 Released With the Fixes for 72 Flaws With 5 Actively Exploited 0-Day

Microsoft has released its May 2025 Patch Tuesday updates, addressing 72 security vulnerabilities across...

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across...

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products,...

Ransomware Attacks Surge by 123% Amid Evolving Tactics and Strategies

The 2025 Third-Party Breach Report from Black Kite highlights a staggering 123% surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across...

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products,...

Zoom Workplace Apps Flaws Allow Hackers to Gain Elevated Access

Zoom has released multiple security bulletins addressing seven newly discovered vulnerabilities in Zoom Workplace...