Analysis Summary

Cybersecurity researchers have reported that a threat actor, codenamed ViciousTrap, has compromised over 5,300 network edge devices across 84 countries, transforming them into a large-scale honeypot-like surveillance network. The attackers primarily exploited a critical vulnerability (CVE-2023-20118) in Cisco Small Business routers—including RV016, RV042, RV042G, RV082, RV320, and RV325 models. The majority of the infections are found in Macau, with around 850 affected devices.

The attackers deployed a malicious shell script named NetGhost, which redirects traffic from specific ports on compromised routers to attacker-controlled infrastructure. This setup allows the threat actor to monitor and intercept network flows, effectively enabling adversary-in-the-middle (AitM) attacks. Researchers noted that the malware also includes a self-removal mechanism to reduce forensic evidence.

Interestingly, the same CVE-2023-20118 vulnerability had previously been linked to another botnet, PolarEdge. Although there is no confirmed connection between the two operations, ViciousTrap actors have repurposed a web shell previously used in PolarEdge, suggesting some level of shared tooling or knowledge reuse.

Researchers believe ViciousTrap is building this honeypot-style network by compromising a broad range of internet-facing devices beyond Cisco routers, including SOHO routers, SSL VPNs, DVRs, and BMC controllers from over 50 different vendors such as ASUS, D-Link, Linksys, and QNAP. This strategy may allow them to collect sensitive threat intelligence, including exploitation attempts and potentially zero-day vulnerabilities.