Two Separate Botnets Exploit Wazuh Server Vulnerability for Mirai-Based Attacks
On June 9, 2025, cybersecurity experts reported that a critical vulnerability in the Wazuh Server is being actively exploited by malicious actors to deploy two different variants of the Mirai botnet. This exploitation has facilitated a series of distributed denial-of-service (DDoS) attacks that pose significant threats to targeted organizations.
The root of this issue lies in a flaw designated CVE-2025-24016, which boasts a high severity rating of 9.9 on the Common Vulnerability Scoring System (CVSS). Discovered by Akamai in late March 2025, the vulnerability enables unsafe deserialization, allowing attackers to execute remote code on vulnerable Wazuh servers. This security defect affects all versions of the software beginning with 4.4.0 and was addressed with the release of version 4.9.1 in February 2025.
At the heart of this vulnerability is the Wazuh API, particularly in its handling of parameters within the Distributed API. Parameters are serialized as JSON and then deserialized through the “as_wazuh_object” method located in the framework/wazuh/core/cluster/common.py file. Attackers have been able to exploit this flaw by injecting malicious JSON, thereby gaining unauthorized access to critical server functionality.
Targets of these botnet attacks include organizations that utilize Wazuh servers for security monitoring and threat detection. The exact geographic locations of the victims are still being assessed, but awareness is crucial for businesses employing such servers. The adversaries behind these attacks exhibit tactics and techniques consistent with the MITRE ATT&CK framework, specifically focusing on initial access, execution, and persistence phases. Initial access was likely achieved through the exploitation of the aforementioned vulnerability, while execution techniques may have involved the execution of injected code.
DDoS attacks are notorious for their capacity to disrupt operations, making it imperative for businesses to remain vigilant against such exploits. The implications of falling prey to these attacks stretch beyond immediate operational downtimes, potentially eroding customer trust and damaging reputations. Companies are encouraged to assess their current Wazuh infrastructure and ensure they are operating on the latest patched versions to mitigate risks associated with such vulnerabilities.
Security teams are advised to adopt comprehensive monitoring of their networks and implement proactive defenses following the principles outlined in the MITRE ATT&CK framework. This includes identifying potential entry points, preparing response protocols, and maintaining up-to-date patch management practices.
As cyber threats continue to evolve, understanding and acting upon vulnerabilities like the one found in Wazuh can be pivotal in safeguarding organizational assets and maintaining robust cybersecurity postures. The urgency of this situation underscores the importance of proactive cybersecurity measures in today’s increasingly interconnected world.
