New Botnet Exploits Simple DNS Flaws That Leads to Massive Cyber Attack

Cybersecurity researchers have uncovered a sophisticated Russian botnet operation that used DNS misconfigurations and compromised MikroTik routers to deliver malware via massive spam campaigns.

The campaign began with a malspam effort identified in November 2024, impersonating DHL Express, and it delivered ZIP files containing obfuscated JavaScript that executed PowerShell and connected to a command and control server at 62.133.60[.]137, tied to Russian threat activity on Global Connectivity Solutions’ infrastructure.

Analysts estimate around 13,000 hijacked MikroTik devices were acting as the botnet’s initial backbone, with the routers spanning multiple firmware versions and functioning as open SOCKS4 proxies to mask traffic origins. A key facet of the operation involved SPF misconfigurations across roughly 20,000 legitimate domains, where domain owners had allowed all mail servers to send spoofed messages, effectively bypassing anti-spam protections.

The researchers warn that this combination of router compromise and DNS misconfigurations enables large-scale malware distribution, data exfiltration, and other malicious activity, and urge organisations to audit DNS SPF records and review internet-facing device security configurations.