Exploitation of Critical Wazuh Server RCE Vulnerability Leads to Mirai Variant Deployment

The Akamai Security Intelligence and Response Team (SIRT) has uncovered active exploitation of a critical remote code execution (RCE) vulnerability in Wazuh servers, identified as CVE-2025-24016 with a CVSS score of 9.9.

Disclosed in February 2025, this vulnerability affects Wazuh versions 4.4.0 through 4.9.0 and stems from unsafe deserialization in the Distributed API (DAPI) requests, allowing attackers to execute arbitrary Python code via maliciously crafted JSON payloads.

Rapid Exploitation of CVE-2025-24016 by Botnets

Akamai first detected exploitation attempts in March 2025 through their global honeypot network, marking the initial reported active abuse of this flaw, which has yet to be added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The flaw, patched in Wazuh 4.9.1, has been weaponized by two distinct botnets to propagate variants of the notorious Mirai malware, targeting primarily Internet of Things (IoT) devices.

The exploitation campaigns observed by Akamai reveal a sophisticated threat landscape.

The first botnet, active since early March 2025, mirrors a publicly available proof-of-concept (PoC) exploit targeting the /security/user/authenticate/run_as endpoint to deploy Mirai variants like “morte,” identified as LZRD derivatives.

These payloads support multiple architectures and fetch malicious shell scripts from IPs such as 176.65.134.62, linked to command-and-control (C2) domains like nuklearcnc.duckdns[.]org.

Multi-Vulnerability Campaigns

A second botnet, dubbed “Resbot” or “Resentual,” emerged in May 2025, targeting the /Wazuh endpoint with payloads named “resgod.”

Notably, its associated domains, such as gestisciweb[.]com, feature Italian nomenclature, potentially indicating a geographically targeted campaign.

Both botnets exploit not only CVE-2025-24016 but also other known vulnerabilities like CVE-2023-1389 (TP-Link Archer AX21) and CVE-2017-17215 (Huawei HG532), demonstrating a multi-vector approach to compromise vulnerable systems.

According to the Report, The rapid weaponization of this Wazuh flaw, within weeks of disclosure, underscores the shrinking time-to-exploit window and the critical need for timely patching to version 4.9.1 or later, as older Wazuh deployments remain at severe risk of compromise.

Organizations are urged to monitor for these IOCs using provided Snort and Yara rules, patch vulnerable Wazuh instances immediately, and remain vigilant for emerging threats leveraging disclosed vulnerabilities and PoCs.

The Akamai SIRT continues to track these botnets and encourages following their research updates for the latest threat intelligence.

Indicators of Compromise (IOCs)

Below is a summarized table of IOCs provided by Akamai SIRT to aid defenders in identifying and mitigating these threats:

Type	Botnet 1	Botnet 2
Malicious IPs	209.141.34.106, 176.65.142.137, 65.222.202.53, 196.251.86.49, 176.65.134.62	104.168.101.27, 104.168.101.23, 79.124.40.46, 194.195.90.179
Malicious Domains	nuklearcnc.duckdns[.]org, jimmyudp-raw[.]xyz, pangacnc[.]com, neon.galaxias[.]cc, cbot.galaxias[.]cc	resbot[.]online, versioneonline[.]com, gestisciweb[.]com (and others)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.