Loading story…
Attackers exploited the Spring4Shell remote code execution flaw, tracked as CVE-2022-22965, to gain code execution on vulnerable Spring Framework applications and deploy Mirai botnet malware. Reporting from Trend Micro showed the vulnerability being weaponized shortly after disclosure, with exploitation attempts targeting exposed Java applications that met the conditions for the flaw.
The observed activity linked a high-profile enterprise software vulnerability to commodity botnet operations, demonstrating how internet-facing servers can be rapidly folded into malware infrastructure after public disclosure. In the documented attacks, successful exploitation led to execution of Mirai-related payloads on compromised systems, underscoring the risk of unpatched Spring deployments being used for botnet propagation and follow-on malicious activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research analyzing exploitation of CVE-2022-22965 (Spring4Shell), including its use to weaponize and execute Mirai botnet malware. The publication indicates technical details of active abuse and attacker tradecraft were publicly documented by this date.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed vulnerability dubbed **Spring4Shell** or **SpringShell** affects certain Spring-based Java applications and could allow remote code execution under specific conditions. Reported prerequisites include use of the `spring-beans` library, **Java 9+**, and **Tomcat 9+**; successful exploitation may let an attacker write a malicious payload to disk for later execution. Public proof-of-concept code was released, increasing the risk of opportunistic testing against exposed systems. The reporting distinguishes Spring4Shell from **`CVE-2022-22963`**, which affects **Spring Cloud Function** and is described as a separate issue rather than the same flaw. At the time covered by the references, there were no official reports of active exploitation in the wild and no official patch yet available, but defenders were provided public mitigation guidance and **YARA** detection rules to help identify vulnerable deployments and possible exploitation attempts.
Jul 16, 2026
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026