Critical Wazuh Server Vulnerability Exploited by Mirai Botnets for DDoS Attacks

TL;DR

A critical security flaw in the Wazuh Server, now patched, has been exploited by threat actors to deploy two Mirai botnet variants for conducting DDoS attacks. Akamai first detected this campaign in late March 2025, targeting the unsafe deserialization vulnerability CVE-2025-24016.

Critical Wazuh Server Vulnerability Exploited for Mirai-Based DDoS Attacks

A recently patched critical security flaw in the Wazuh Server has been actively exploited by cybercriminals to deploy two distinct Mirai botnet variants. These botnets are then used to launch distributed denial-of-service (DDoS) attacks. Akamai, the cybersecurity firm that first identified this malicious activity in late March 2025, reported that the attacks are targeting CVE-2025-24016. This vulnerability, with a CVSS score of 9.9, involves an unsafe deserialization issue¹.

Understanding the Vulnerability

CVE-2025-24016 is a severe vulnerability that allows attackers to execute arbitrary code on affected systems. This flaw arises from the unsafe deserialization of untrusted data, leading to remote code execution. The high CVSS score of 9.9 underscores the critical nature of this vulnerability, making it a prime target for malicious actors.

Exploitation and Impact

The exploitation of this vulnerability enables threat actors to infiltrate systems and deploy Mirai botnet variants. Mirai is notorious for its role in some of the largest DDoS attacks in history. By compromising the Wazuh Server, attackers can leverage the infected systems to participate in large-scale DDoS campaigns, causing significant disruptions to online services.

Mitigation and Protection

To mitigate the risks associated with CVE-2025-24016, it is crucial for organizations to apply the latest security patches provided by Wazuh. Additionally, implementing robust security measures such as network monitoring, regular vulnerability assessments, and using secure coding practices can help prevent similar incidents in the future.

Conclusion

The exploitation of the Wazuh Server vulnerability highlights the ongoing threat posed by botnets and the importance of prompt patch management. As cyber threats continue to evolve, staying vigilant and proactive in security measures is essential for protecting against such attacks.

For more details, visit the full article: The Hacker News

References

1. (2025). “Botnet Exploits Wazuh Server Vulnerability for DDoS Attacks”. The Hacker News. Retrieved 2025-06-09. ↩︎