Attackers Exploit IoT Vulnerabilities to Deploy New ShadowV2 Malware

In late October 2025, alongside a global AWS service outage, a new malware attack campaign codenamed ShadowV2 emerged. This advanced threat constructs a botnet by exploiting vulnerabilities in Internet of Things (IoT) devices, specifically to carry out Distributed Denial of Service (DDoS) attacks. Its rapid spread indicates that attackers are systematically leveraging infected hardware to conduct large-scale destructive activities.

Rapid Spread Across Industries

The malware has quickly affected seven major industries, including technology, education, and retail, impacting numerous organizations across the United States, Europe, and Asia. Security experts believe that the surge in attacks is likely a “test run” by attackers to assess the botnet’s capability to cause widespread service disruptions. The extensive nature of this attack highlights the ongoing risks posed by unprotected connected devices in enterprise environments.

Exploiting Known Vulnerabilities to Penetrate Devices

Fortinet security analysts discovered that the malware exploits unpatched old vulnerabilities in routers and DVR devices from manufacturers such as D-Link and TP-Link. By targeting these known weaknesses, attackers successfully compromised a large number of devices that had not updated their firmware in a timely manner. The attack chain begins with forcing vulnerable devices to download a script named <span>binary.sh</span> from a remote server (81.88.18.108).

As shown in the figure, the script automatically detects the host architecture (ARM, MIPS, or x86) and retrieves the corresponding malware payload to ensure successful execution.

Technical Analysis of ShadowV2

ShadowV2 adopts the architecture of the “LZRD” variant of Mirai but employs unique obfuscation techniques. Upon startup, it uses a simple XOR encryption with the key <span>0x22</span> to decrypt its configuration.

The decrypted hidden data includes file paths (such as <span>/proc/</span>) and deceptive User-Agent strings used to disguise malicious traffic as legitimate user activity.

Once activated, the malware establishes a connection with its command and control server to receive attack instructions. It supports various DDoS attack vectors, including UDP flooding and TCP SYN flooding attacks, and maps these behaviors through specific internal function IDs for rapid deployment against targets.

Source:

Hackers Actively Exploiting IoT Vulnerabilities to Deploy New ShadowV2 Malware