ViciousTrapThreat actor
ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots and utilizing a shell script called NetGhost to redirect incoming traffic from specific ports to their infrastructure. The actor has targeted various EOL devices, including ASUS routers, Linksys LRT224, and Araknis Networks AN-300-RT-4L2W VPN routers.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1110Brute Force
“Attackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs.”
- T1505.003Web Shell
“…upport of this hypothesis, interactions observed on TDR’s honeypots revealed attempts by the attacker to reuse a previously documented web shell to deploy their redirection script.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ViciousTrap: Turning Edge Devices into Honeypots at Scale“ViciousTrap: Turning Edge Devices into Honeypots at Scale”
-
GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers“May 22, 2025: Sekoia announces compromise of ASUS routers as part of ‘ViciousTrap.’”
Indicators in its reports
named in the reports above- 101.99.91[.]151in 2 reports
- 101.99.94[.]173in 2 reports
- 111.90.148[.]151in 1 report
- 111.90.148[.]112in 1 report
- 101.99.91[.]239in 1 report
- c15f77d64b7bbfb3…95562b37dec4in 1 report
- 212.232.23[.]217in 1 report
- 155.254.60[.]160in 1 report
- 103.43.19[.]61in 1 report
- 103.56.17[.]163in 1 report
- 103.43.18[.]59in 1 report
- 212.232.23[.]168in 1 report
- 212.232.23[.]143in 1 report
- 101.99.90[.]20in 1 report
- d92d2f102e1e4178…a799507e3e77in 1 report
- 20dff1120d968330…4e59474dc6bdin 1 report
- 79.141.163[.]179in 1 report
- 111.90.146[.]237in 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.