A new variant of the Mirai-based botnet malware, Aquabotv3, has been identified actively exploiting CVE-2024-41710, a command injection flaw in Mitel SIP phones. This development marks the third version of Aquabot tracked by Akamai’s Security Intelligence and Response Team (SIRT).
Originally introduced in 2023, Aquabot has undergone multiple iterations. The second version introduced persistence mechanisms, while the latest variant, Aquabotv3, features a novel system that detects termination signals and reports them to the command-and-control (C2) server. Akamai notes that this mechanism is unusual for botnets and may have been implemented to enhance monitoring capabilities for its operators.
Targeting Mitel SIP Phones
The vulnerability, CVE-2024-41710, affects Mitel 6800, 6900, and 6900w Series SIP phones used in corporate, government, healthcare, education, financial, and hospitality sectors. It allows an authenticated attacker with admin privileges to execute arbitrary commands due to improper input sanitization during the boot process.
Mitel issued patches for this flaw on July 17, 2024, and urged users to update their devices. However, a proof-of-concept (PoC) exploit was published two weeks later on GitHub by security researcher Kyle Burns. Aquabotv3 is the first documented malware to weaponize this exploit.
Akamai’s honeypot network detected exploit attempts in early January 2025. The attacks involve sending HTTP POST requests to the vulnerable endpoint 8021xsupport.html, which manages authentication settings. Attackers manipulate user input to modify the device’s local configuration file (/nvdata/etc/local.cfg) and inject commands that download and execute a remote shell script. This script installs Aquabotv3 for the targeted device architecture (x86, ARM, MIPS, etc.), assigns execution permissions, and erases traces of the attack.
Propagation and Attack Mechanisms
Once a device is compromised, Aquabotv3 establishes a connection to its C2 server via TCP, allowing operators to issue commands, deploy updates, and launch attacks. The malware attempts to propagate further by exploiting:
- CVE-2018-17532 (TP-Link)
- CVE-2023-26801 (IoT firmware RCE)
- CVE-2022-31137 (Web App RCE)
- Linksys E-series RCE
- Hadoop YARN Exploit
- Dasan router vulnerabilities (CVE-2018-10562 / CVE-2018-10561)
Additionally, Aquabotv3 uses brute-force attacks on SSH and Telnet credentials to compromise other IoT devices within the network.
DDoS Capabilities and Underground Promotion
Aquabotv3’s primary function is to build a botnet for large-scale Distributed Denial-of-Service (DDoS) attacks. It supports multiple attack vectors, including:
- TCP SYN and TCP ACK floods
- UDP-based attacks
- GRE IP-based attacks
- Application-layer DDoS attacks
The botnet is advertised on Telegram under names such as Cursinq Firewall, The Eye Services, and The Eye Botnet, promoting it as a DDoS testing tool.
Detection and Mitigation
Akamai has released Indicators of Compromise (IoCs), along with Snort and YARA rules, to help organizations detect and mitigate Aquabotv3 infections. Security teams are urged to apply Mitel’s patches, enforce strong authentication policies, and monitor network traffic for unusual activity.
As botnets evolve, organizations must remain vigilant against emerging threats that target IoT devices, ensuring timely updates and proactive security measures.
Comments