Signal

Mirai botnet exploits critical flaw in discontinued D-Link DIR-823X routers

Evidence first: scan the strongest sources, then decide whether to go deeper.

Published 2026-04-22 20:04 UTCUpdated 2026-04-23 15:13 UTC
rss
cveexploitsmalwarethreat_actorsincident_response
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.
2 top sources shown
New Mirai campaign exploits RCE flaw in EoL D-Link routers
bleepingcomputer_all · News · bleepingcomputer.com · 2026-04-22 20:04 UTC
limited source diversity in top sources
Overview

A new Mirai malware campaign is actively exploiting a high-severity command injection vulnerability (CVE-2025-29635) in end-of-life D-Link DIR-823X routers. The flaw, disclosed about a year ago, allows remote code execution, enabling attackers to enlist vulnerable devices into the Mirai botnet.

Entities
D-LinkMiraiBill Toulas
Score total
1.02
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
  • Active exploitation has been ongoing since early March 2026.
  • The vulnerability was disclosed about a year ago, yet remains unpatched in many devices.
  • Awareness is critical to prevent further spread of Mirai infections through these routers.
Why it matters
  • Discontinued routers remain vulnerable to active botnet exploitation.
  • Mirai botnet infections can disrupt networks and facilitate further attacks.
  • Users of legacy devices need to prioritize patching or replacement to reduce risk.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
  • Mirai botnet is actively exploiting CVE-2025-29635 in D-Link DIR-823X routers to enlist devices into the botnet.
How sources frame it
  • Bill Toulas: neutral
All evidence
All evidence
Discontinued D-Link routers subjected to Mirai botnet targeting
SC Media · scworld.com · 2026-04-23 15:13 UTC
New Mirai campaign exploits RCE flaw in EoL D-Link routers
bleepingcomputer_all · bleepingcomputer.com · 2026-04-22 20:04 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
  • SC Media (1)
  • bleepingcomputer_all (1)
Top origin domains (this list)
  • scworld.com (1)
  • bleepingcomputer.com (1)