-----
Mike Hammett
Intelligent Computing Solutions
http://www.ics-il.com

Midwest-IX
http://www.midwest-ix.com

From: "Töma Gavrichenkov" <ximaera@gmail.com>
To: "NANOG" <nanog@nanog.org>
Sent: Thursday, September 9, 2021 4:41:03 AM
Subject: Mirai botnet is back — now as "Meris"

Peace,

An undisclosed (or, even, yet undiscovered by the vendor)
vulnerability in SOHO Mikrotik routers seems to be exploited by
someone.
Approx. 328 thousand devices already joined the botnet, with each
having unrestricted access to the uplink (up to 1 Gbps).  42,6% of
exploited devices reside in the U.S.

https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/

I didn't know Mikrotik was so popular in North America!
Patching all those SOHO WiFi routers must be fun...

--
Töma