PREVIOUSLY UNIDENTIFIED BOTNET TARGETS UNPATCHED TP-LINK ARCHER HOME ROUTERS

Summary from the TLDR InfoSec newsletter

Cato Networks has detected a new botnet named Ballista that is targeting unpatched TP-Link Archer routers using the CVE-2023-1389 exploit. Researchers suggest the hacker is likely from Italy and that the botnet is in its early stages, with evolving malware capabilities. Unlike other DDoS-for-hire botnets, Ballista's malware can also execute arbitrary commands on remote systems.