Botnets Step Up Cloud Attacks Via Flaws, Misconfigurations

A wave of known botnets including Mirai, Gafgyt and Mozi is ramping up attacks on Web-exposed assets such as PHP servers, IoT devices and cloud gateways by exploiting misconfigurations and known vulnerabilities to take control of systems. The report notes that these botnets are conducting automated campaigns that can lead to remote code execution, data exfiltration or turning servers into distribution points for further malware, with millions of affected assets potentially exposed.

These campaigns target cloud-native environments via exposed APIs and misconfigured services, and they include attacks using thousands of source IPs from providers such as Google Cloud Platform, AWS, Microsoft Azure, Digital Ocean and Akamai Cloud, according to Qualys. The article highlights critical CVE flaws linked to PHP deployments and IoT devices, including CVE-2022-47945, CVE-2021-3129, CVE-2017-9841, CVE-2024-3721 and CVE-2022-22947, which attackers can exploit for RCE or remote execution.

It also cites PHP powering over 73% of websites and that 82% of enterprises report cloud misconfiguration incidents, underscoring the breadth of the modern attack surface. In addition, misconfigurations such as exposed AWS credential files on Linux servers and insecure IoT devices with outdated firmware provide entry points, while the TRU from Qualys urges regular updates and the removal of development and debug tools from production to reduce risk.