In light of the research, it has been observed that since the beginning of August 2022, attempts to exploit the vulnerability that weaponized a newly patched critical remote code execution flaw in the Realtek Jungle SDK began to spike.

According to Palo Alto Networks Unit 42, it was reported that there were 134 million exploit attempts as of December 2022 in the ongoing process, and 97% of the attacks occurred in the last 4 months. 

95% of attacks exploiting the Russian vulnerability targeted organizations in Australia. 

“Most of the attacks we observed attempted to infect vulnerable IoT devices with malware,” the Unit 42 researchers report. “Threat groups have been exploiting these vulnerabilities to launch attacks on smart devices around the world on a larger scale,” he continued.

The vulnerability in question appears as CVE-2021-35494 (CVSS Score: 9.8). This vulnerability is a random command injection bug that can be weaponized to carry a series of buffers and execute arbitrary code with the highest level of privilege and take over affected devices.

A new Golang-based Distributed Denial of Service (DDoS) botnet called RedGoBot is also introduced, alongside botnets such as Mirai, Gafgyt, and Mozi, through the exploitation of the CVE-2021-35394 vulnerability.

This issue was revealed by former IoT inspector ONEKEY in August 2021. The impact of these vulnerabilities D-Link, LG, Belkin, ASUS and NETGEAR affected their devices on a large scale.

When the attack data of 12 different IP addresses, 5 different countries and a total of 96.9 million are shared, the percentages are approximately 60% United States of America, 23% Vietnam, 10.2% Netherlands, 5.6% France and 1.2%. It originates from Russia with my tongue.