Akamai SIRT identifies Mirai variant campaign actively targeting critical RCE flaws in automation platforms and routers

Mirai #Zerobot #Botnet #n8n #Tenda #CVE-2025-68613 #CVE-2025-7544

Affected products
n8n workflow automation platform (versions 0.211.0 prior to 1.120.4, 1.121.1 and 1.122.0) and Tenda AC1206 routers (firmware 15.03.06.23)

Campaign type
Mirai-based botnet propagation via command injection and buffer overflow

Exploitation status
Observed in the wild

Severity
Critical

Patch / mitigation status
Available for n8n since December 2025; Tenda firmware updates recommended

Sectors at risk
Organisations using self-hosted automation platforms and exposed IoT routers

Regions at risk
Global

Publication context
New report

Executive Summary

The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of two critical vulnerabilities by a Mirai-based botnet dubbed Zerobot. The campaign, which dates back to at least December 2025, targets CVE-2025-68613 in the n8n automation platform and CVE-2025-7544 in Tenda AC1206 routers. Activity was first detected in Akamai’s global honeypot network in mid-January 2026.

Targeting of n8n is particularly significant because the platform is often deployed in enterprise environments for critical workflow automation. Successful compromise could enable lateral movement and persistence beyond typical IoT botnet behaviour. Public proof-of-concept exploits exist for both vulnerabilities.

Akamai has published a comprehensive list of indicators of compromise to support defensive action.

Context

Zerobot represents an evolution of Mirai botnet tooling that opportunistically exploits recently disclosed vulnerabilities rather than relying on zero-days. The campaign began with simpler netcat and socat techniques in December 2025 before shifting to wget and curl-based downloaders in January 2026.

While earlier Zerobot activity was documented by Fortinet in 2022, the relationship between that Go-based family and the current zerobotv9 variant remains unconfirmed. This iteration uses a smaller, non-Go binary with the classic Mirai XOR key 0x22 and introduces additional attack functions including TCPXmas, Mixamp, SSH and Discord.

The n8n targeting marks a departure from purely IoT-focused campaigns and increases risk to organisational infrastructure.

Technical Analysis

Zerobot exploits two vulnerabilities to achieve remote code execution and deliver its payload.

CVE-2025-7544 (Tenda AC1206) is a remote stack-based buffer overflow in the /goform/setMacFilterCfg endpoint. It affects firmware version 15.03.06.23 and is triggered via the deviceList parameter. The vulnerability occurs in the parse_macfilter_rule function where unchecked input is passed to strcpy, allowing stack overflow and arbitrary code execution. According to the NVD entry for CVE-2025-7544, exploitation can lead to denial of service or full remote code execution. A public proof-of-concept is available.

CVE-2025-68613 (n8n) is an authenticated remote code execution vulnerability in the workflow expression evaluation engine. It affects n8n versions from 0.211.0 up to but excluding the patched releases 1.120.4, 1.121.1 and 1.122.0. Insufficient sandboxing allows authenticated users (even without administrative privileges) to escape the expression context and execute arbitrary system commands. According to the n8n security advisory, successful exploitation grants full server access, including file read/write operations and environment variable theft. The n8n advisory and NVD entry for CVE-2025-68613 provide full technical details.

In observed attacks, the initial exploit requests download a shell script (tol.sh) from IP address 144.172.100.228. This script then fetches architecture-specific zerobotv9 binaries (x86, MIPS, ARM, PPC and others) and executes them. The malware connects to the hard-coded C2 domain 0bot.qzz.io and includes the execution string “bruh why again”.

Observed techniques map to the following MITRE ATT&CK entries:

• T1190 – Exploit Public-Facing Application
• T1059.004 – Command and Scripting Interpreter: Unix Shell
• T1105 – Ingress Tool Transfer

The same downloader logic appears in attacks against older vulnerabilities such as CVE-2017-9841, CVE-2021-3129 and CVE-2022-22947.

MITRE ATT&CK mapping

Impact Assessment

Compromise of n8n instances poses elevated risk because the platform frequently integrates with databases, cloud services and internal systems. Attackers could exfiltrate sensitive data, steal API keys or establish persistence within enterprise environments. Tenda router infections contribute to distributed denial-of-service capacity in the classic Mirai model.

Given the low barrier to entry for Mirai variants and the availability of public PoCs, organisations with exposed instances face immediate threat.

Indicators of Compromise

Akamai SIRT has provided the following IOCs with high confidence.

Detection guidance
Akamai SIRT has released the following rules (sourced directly from their report):

Snort rules for malicious IPs and C2 domains are available in the original post.

YARA rule Mirai_Malware_IOCs_1 detects strings including “bruh why again”, “mamakmukekkontol” and the listed domains and hashes.

Mitigation Recommendations

• Upgrade n8n immediately to version 1.122.0 or later.
• Update Tenda AC1206 firmware or isolate devices from the internet.
• Block all listed IOCs at network perimeter and endpoint layers.
• Restrict n8n workflow editing permissions to trusted users only.
• Monitor for suspicious process executions and outbound connections to the listed domains.
• Deploy network segmentation to limit lateral movement from compromised automation servers.

Threat Intelligence Context

This activity continues the long-standing Mirai ecosystem trend of low-effort, high-volume exploitation of n-day vulnerabilities. The inclusion of enterprise automation platforms alongside traditional IoT targets reflects broadening attacker interest in higher-value infrastructure. Similar campaigns have repeatedly demonstrated that public PoCs accelerate widespread exploitation within weeks of disclosure.

Future Outlook

Expect continued opportunistic targeting of recently disclosed vulnerabilities in automation and IoT products. Botnet operators will likely incorporate additional n-day exploits as they become public, with low-skill actors reusing modified Mirai code or AI-assisted tooling to maintain operations below the radar of major takedowns.

Further Reading

• Akamai SIRT research: Zerobot Malware Targets n8n Automation Platform
• n8n security advisory for CVE-2025-68613
• NVD entry for CVE-2025-68613
• NVD entry for CVE-2025-7544
• Fortinet 2022 analysis of original Zerobot campaign