UNSTABLE Botnet

The UNSTABLE Botnet project is very similar to the SORA Botnet, and, in fact, both of these campaigns were discovered just a few days apart in February 2020. Just like the SORA Botnet, this one also relies on CVE-201717215 and CVE-2018-10564 to hunt for vulnerable Internet-of-Things (IoT) devices, but it may also test them for a less-known ThinkPHP Remote Code Execution (RCE) vulnerability.

Since the authors of the UNSTABLE Botnet have based their entire project on the Mirai Botnet source code, it is safe to assume that both projects serve a similar purpose – executing Distributed-Denial-of-Service (DDoS) attacks. It is very likely that UNSTABLE Botnet's operators will opt to monetize this campaign by allowing other cybercriminals to pay for access to the botnet's DDoS panel.

While neither the UNSTABLE Botnet nor the Sora Botnet have reached impressive sizes, they are still threatening projects that are only likely to grow in the future. To prevent botnet campaigns from becoming larger, users need to take the appropriate measures to protect the Internet-of-things (IoT) devices the criminals may go after. This can be done by applying security patches and fixes, as well as by following the best security practi