ViciousTrap Hackers Breaches 5,500+ Edge Devices from 50+ Brands, Turns Them into Honeypots

A sophisticated cyber threat actor, dubbed ViciousTrap by Sekoia.io’s Threat Detection & Research (TDR) team, has compromised over 5,500 edge devices across more than 50 brands, transforming them into a massive honeypot-like network.

This alarming operation, detailed in Sekoia.io’s latest investigation, targets a wide array of internet-facing equipment, including Small Office/Home Office (SOHO) routers, SSL VPNs, DVRs, and Baseboard Management Controllers (BMCs) from vendors like Cisco, D-Link, Linksys, ASUS, QNAP, and Araknis Networks.

The attacker, potentially of Chinese-speaking origin based on infrastructure overlaps with GobRAT and geographic targeting patterns, appears to be constructing a distributed system to intercept network traffic and possibly harvest zero-day exploits or reuse access gained by other malicious actors.

Unprecedented Cyber Espionage Campaign

The infection chain begins with the exploitation of known vulnerabilities such as CVE-2023-20118, primarily affecting Cisco SOHO routers, with initial attacks traced back to March 2025 from the IP address 101.99.91[.]151.

ViciousTrap deploys a shell script named NetGhost, which redirects inbound traffic on specific ports (80, 8000, or 8080) to attacker-controlled interception servers using iptables for Man-in-the-Middle (MitM) capabilities.

The script, retrieved via a MIPS-compiled wget binary, also notifies the command-and-control (C2) infrastructure with unique identifiers per victim, registering compromised systems for further manipulation.

Sekoia.io observed the reuse of a previously undocumented webshell in April 2025, suggesting ViciousTrap passively collects attack data from its honeypot network to repurpose exploits.

A recent campaign targeting ASUS routers via CVE-2021-32030 has potentially compromised over 9,500 devices by establishing SSH access on port 53282, though no honeypots were created on these systems.

Technical Depth of the Attack Strategy

The attacker’s infrastructure, hosted primarily in Malaysia under Shinjiru (AS45839), includes exploitation, notification, and interception servers like 111.90.148[.]151 and 111.90.148[.]112, which monitor nearly 60 distinct device types by replicating SSL certificates and HTTP responses.

Detection is possible due to consistent TCP window sizes (64240) and unique JARM hashes identifying redirected traffic, with over 5,300 compromised hosts spanning 84 countries, notably Macao, due to outdated D-Link DIR-850L routers.

The ultimate goal of ViciousTrap remains elusive, though Sekoia.io hypothesizes it aims to build a honeypot-style network for espionage, focusing on assets in Taiwan and the US while conspicuously avoiding China.

This campaign marks a rare instance of edge devices being weaponized into relay nodes, underscoring the risks of end-of-life (EOL) hardware and unpatched vulnerabilities.

Indicators of Compromise (IoCs)

Category	Value
Exploitation Servers	101.99.91[.]151, 101.99.91[.]239
Redirection Servers	111.90.148[.]151, 111.90.148[.]112
Other Infrastructure	212.232.23[.]217, 155.254.60[.]160, 101.99.94[.]173, 103.43.19[.]61, 103.56.17[.]163, 103.43.18[.]59, 212.232.23[.]168, 212.232.23[.]143, 101.99.90[.]20, 101.99.91[.]239
Malware Hashes	d92d2f102e1e417894bd2920e477638edfae7f08d78aee605b1ba799507e3e77, 20dff1120d968330c703aa485b3ea0ece45a227563ca0ffa395e4e59474dc6bd

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!