This worrying botnet targets unsecure TP-Link routers – thousands of devices already hacked

Old TP-Link router flaw is being abused again The threat actors are building out a botnet named Ballista They are operating from Italy Italian hackers are abusing a vulnerability in TP-Link Archer routers to spread a new botnet, cybersecurity experts from Cato Network have reported. The researchers said they observed a previously unreported global internet-of-things (IoT) botnet campaign, which started to spread in the early days of 2025. The botnet exploits a remote code execution (RCE) vulnerability in the routers, tracked as CVE-2023-1389. Manufacturing, healthcare, and tech targets This vulnerability has been exploited for botnet building in the past as…