Emerging IoT Threat: The Ballista Botnet Targets Thousands of TP-Link Archer Routers

A new and significant cyber threat has emerged, with researchers discovering a sophisticated IoT botnet campaign that has already compromised thousands of routers across the globe. The botnet, known as Ballista, is specifically targeting TP-Link Archer routers by exploiting a critical remote code execution (RCE) vulnerability in their firmware (CVE-2023-1389).

The Ballista botnet campaign was first identified by cybersecurity researchers at Cato CTRL on January 10, 2025. Within a matter of weeks, the botnet’s activity ramped up significantly, spreading across multiple continents, including the U.S., Australia, China, and Mexico. The attackers have already exploited over 6,000 vulnerable devices, taking full control of these routers for nefarious purposes, including launching large-scale distributed denial-of-service (DDoS) attacks.

The Attack Mechanism: Exploiting a Critical Vulnerability

The core exploit in the Ballista botnet relies on a vulnerability found in the web management interface of TP-Link Archer routers. This vulnerability, identified as CVE-2023-1389, stems from inadequate sanitization of user inputs in a specific endpoint of the router’s firmware. This flaw allows attackers to execute remote commands with root privileges without requiring any authentication.

The attack sequence begins with a payload that exploits this vulnerability to install a dropper script on the compromised router. The dropper, a bash script named dropbpb.sh, downloads and executes the main malware payload. The payload then sets up a Command and Control (C2) channel on port 82, over which attackers can issue shell commands, spread the botnet, and launch DDoS attacks.

The malware also attempts to read sensitive configuration files on the affected device, such as /etc/passwd, /etc/shadow, and SSL certificates, which could potentially be exploited for further attacks or data exfiltration.

The Ballista Botnet’s Evolving Tactics

What makes the Ballista botnet particularly concerning is its ability to adapt and evolve its methods of operation. Initially, the botnet relied on static IP addresses to communicate with compromised devices. However, as researchers began investigating the botnet, the attackers shifted to using Tor domains for their C2 channels, allowing them to better conceal their operations and evade detection.

This move suggests an increase in sophistication by the threat actor behind the botnet. The use of Tor networks makes it difficult for cybersecurity professionals to track the botnet's infrastructure, thus complicating efforts to mitigate its spread.

Targeted Industries and Global Reach

The Ballista botnet is not limited to residential routers. According to research from Cato CTRL, the botnet has impacted several industries, including manufacturing, healthcare, and technology. The attackers have been targeting critical infrastructure across the U.S., Australia, China, and Mexico, compromising not only consumer-grade routers but also devices used by businesses and government entities.

These industries rely heavily on IoT devices, which are often left unsecured, making them prime targets for cybercriminals. Researchers have noted that the botnet has been spreading rapidly through unsecured TP-Link devices globally, with many organizations still relying on outdated router firmware, further exacerbating the problem.

A Threat Actor with a Purpose

Cato CTRL's threat analysis indicates that the Ballista botnet is likely the work of an Italian-based cybercriminal group. The evidence supporting this theory includes Italian strings found within the malware binaries and the IP address location (2.237.57[.]70), which traces back to Italy.

While the true motivation behind the attack is still unclear, researchers suspect that the botnet may be used for financial gain, including launching massive DDoS attacks or using the compromised devices for cryptocurrency mining. The botnet’s modular design allows for additional functionalities to be deployed via C2 commands, further expanding the potential for abuse.

A Closer Look at the Malware's Capabilities

The malware behind the Ballista botnet exhibits several alarming features that make it particularly dangerous:

1. Self-Replicating Behavior: The botnet spreads by exploiting the CVE-2023-1389 vulnerability in other vulnerable routers, making it a self-propagating threat.

2. Command and Control (C2) Communication: Once a device is infected, the malware establishes a secure, encrypted C2 channel over TLS (Transport Layer Security) on port 82. This allows the attackers to issue commands and control the botnet remotely.

3. File and Directory Manipulation: The malware attempts to read critical system files (such as /etc/passwd, /etc/shadow, /etc/resolv.conf), potentially facilitating credential harvesting and lateral movement across networks.

4. Distributed Denial of Service (DDoS): The botnet has the ability to initiate DDoS attacks against other networks, using the infected devices as part of a larger botnet army.

5. Persistence Mechanisms: Upon infection, the malware ensures that it remains active on the compromised device by killing previous instances of itself and deleting all traces of its presence.

How Organizations Can Defend Against Ballista

With IoT devices like the TP-Link Archer router becoming a target for cybercriminals, organizations need to take proactive measures to secure their devices and networks. The first and most crucial step is ensuring that all firmware is up-to-date to mitigate vulnerabilities such as CVE-2023-1389.

Organizations are advised to:

• Regularly update and patch firmware for all IoT devices.
• Use strong, unique passwords for device management interfaces to prevent unauthorized access.
• Employ network segmentation to isolate IoT devices from critical infrastructure.
• Implement security monitoring tools to detect unusual network activity or signs of compromise.

Cato CTRL’s Response to the Threat

Cato Networks has implemented several security layers to combat the Ballista botnet and similar threats. Their SASE (Secure Access Service Edge) platform offers:

• Intrusion Prevention System (IPS): Tailored protections for blocking CVE-2023-1389 and detecting malicious activities, such as lateral movement and C2 communication.

• IoT/OT Security: A comprehensive device identification system that allows administrators to create tailored security policies for their IoT devices, ensuring a more robust defense against botnet threats.

Conclusion: A Wake-Up Call for IoT Security

The Ballista botnet is a clear reminder of the vulnerabilities that continue to exist in IoT devices, which are often poorly maintained and lack adequate security. The botnet has already impacted thousands of devices, and its potential for widespread damage is significant.

As IoT devices become a central part of global infrastructure, cybersecurity must evolve to keep pace with the growing sophistication of cybercriminals. Organizations that rely on IoT devices must prioritize device security, regular updates, and monitoring to protect themselves from emerging threats like the Ballista botnet.