Cybersecurity researchers have uncovered a concerted campaign where hackers are actively exploiting vulnerabilities in Internet of Things (IoT) devices to deploy a potent new malware variant known as “ShadowV2.”
The timing and behavior of the malware have led analysts to believe this activity was likely a “test run” by threat actors to gauge the malware’s efficacy in preparation for future, larger-scale attacks.
Discovered by FortiGuard Labs, the campaign was first observed in late October, coinciding precisely with a global disruption of Amazon Web Services (AWS) connections.
While the malware appears to have only been active during the window of the widespread AWS outage, its impact was immediate and far-reaching.
The incidents spanned the globe, affecting organizations in North and South America, Europe, Africa, Asia, and Oceania. Specific countries targeted included the United States, Brazil, the United Kingdom, France, China, Russia, and Australia.
The victims were not limited to a single sector; the attacks compromised entities across seven distinct industries, including technology, manufacturing, government, telecommunications, and managed security services providers (MSSPs).
Technical Mechanics: A Mirai Evolution
ShadowV2 is assessed to be a derivative of the notorious Mirai botnet architecture, explicitly re-engineered for IoT environments.
During execution, the malware displays the string “ShadowV2 Build v1.0.0 IoT version,” suggesting this is the initial release targeting these specific devices.
The infection chain begins with a downloader script named binary.sh. This script exploits specific security gaps to deliver the ShadowV2 payload from a remote server.
Once installed, the malware utilizes XOR-encoded configurations to mask its activities and attempts to contact its Command and Control (C2) server at silverpath[.]shadowstresser[.]info.
- DDWRT: CVE-2009-2765.
- D-Link: CVE-2020-25506, CVE-2022-37055, CVE-2024-10914, CVE-2024-10915.
- DigiEver: CVE-2023-52163.
- TBK: CVE-2024-3721.
- TP-Link: CVE-2024-53375.
If successful, the attackers gain remote control of the vulnerable system. The malware is equipped with a versatile arsenal of Distributed Denial of Service (DDoS) capabilities, including UDP floods, TCP floods, and HTTP-level attacks, allowing the botnet to overwhelm targeted networks with traffic.
ShadowV2 supports two transport-layer protocols (UDP and TCP) and the HTTP application protocol.
Affected Platforms
The emergence of ShadowV2 highlights a strategic by threat actors toward the IoT landscape, where firmware is often left outdated.
The campaign targets a mix of legacy and modern vulnerabilities across several major hardware vendors. Organizations utilizing the following hardware are considered at high risk:
- D-Link: Multiple models including DNS-320, DNS-320LW, DNS-325, DNS-340L, and the GO-RT-AC750 router series.
- DD-WRT: Devices running version 24 sp1 (exploiting a vulnerability from as far back as 2009).
- TP-Link: The popular Archer router series.
- Digiever: DS-2105 Pro NVRs.
- TBK: DVR-4104 and DVR-4216 recording systems.
FortiGuard Labs has classified the severity of this threat as High. The successful exploitation of these devices allows remote attackers to fully compromise the system, potentially using the victim’s infrastructure to launch further attacks.
Security experts are urging all organizations to immediately patch the listed devices, enforce robust security practices, and monitor network traffic for communication with known ShadowV2 C2 domains to ensure ecosystem resilience before the next wave of exploits begins.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 devices.){kind=link}