Two Mirai Botnets Exploit Critical Wazuh Vulnerability (CVE-2025-24016)

Critical Wazuh Vulnerability Exploited

• 🎯 A critical Remote Code Execution (RCE) vulnerability, CVE-2025-24016, has been actively exploited in Wazuh servers.
• ⚠️ The vulnerability affects Wazuh versions 4.4.0 through 4.9.0, with version 4.9.1 being the patched release.
• 📈 It stems from an unsafe deserialization in Wazuh, allowing threat actors to execute arbitrary code, establish backdoors, or perform other malicious actions.
• 🚨 The vulnerability is rated 9.9 critical on the CVSS scale, indicating its severe impact.

Rapid Exploitation and Botnet Activity

• ⚡ Two distinct Mirai-based botnets were observed exploiting this vulnerability shortly after its disclosure.
• 💡 The rapid response is attributed to the availability of a proof-of-concept exploit published in February, making it trivial for attackers to weaponize.
• 💬 Threat actors actively monitor security articles and CVE publications, quickly adopting new exploits into their arsenals.
• ⏳ Organizations, especially large ones, often have a significant patching window, allowing attackers to gain access before systems are secured.

Botnet Campaigns and Tactics

• 🔍 One botnet campaign utilizes the long-standing Wizard variant of Mirai, alongside other variants like F3 G4 (dubbed Vega).
• 🇮🇹 A second campaign, referred to as Resbot, uses a specific Mirai variant and exhibits unusual C2 domains that appear to target Italian-speaking users.
• 🎯 This regional targeting might be an attempt to make malicious domains appear more legitimate to network defenders, reducing suspicion.
• 🛠️ The exploitation chain typically involves executing arbitrary code to download and run a shell script, which then fetches and executes the main Mirai malware payload.

Defense and Mitigation Strategies

• 🔑 The most crucial defense is to patch vulnerable Wazuh systems immediately to the latest version.
• 🔒 Wazuh servers should not be publicly accessible on the internet unless absolutely necessary and protected by additional filters.
• 📊 Researchers identified over 5,000 publicly accessible Wazuh servers through census queries, highlighting the exposure risk.
• 🌐 Securing APIs and ensuring systems are not exposed unnecessarily are key steps to prevent exploitation.

The Double-Edged Sword of Public Exploits

• ⚖️ The public disclosure of vulnerabilities and proof-of-concept exploits presents a dilemma: it aids defenders in identifying and mitigating threats but also enables rapid weaponization by attackers.
• 🤝 Potential alternatives include distributing exploit code within trusted partnership groups rather than making it publicly available.
• 🤔 While the CVE program generally does more good than harm, the necessity and public accessibility of proof-of-concept exploits warrant ongoing discussion within the security community.