A critical remote code execution (RCE) vulnerability is under active exploitation via a new malware botnet used to takeover Wi-Fi access points to conduct distributed denial-of-service (DDoS) attacks. The botnet is named “AndoryuBot”, and the flaw it is exploiting exists in the Ruckus Wireless Admin panel within Ruckus wireless devices. The vulnerability, tracked as CVE-2023-25717, has a CVSS score of 9.8/10 and allows the threat actor to conduct RCE by sending maliciously crafted HTTP GET requests to vulnerable Ruckus Wireless devices. After the malware successfully infects a vulnerable wireless device, it downloads an additional script that establishes communication with actor-controlled command and control (C2) servers. This is covertly executed by utilizing the Socket Secure (SOCKS) proxy protocol, a network protocol that facilitates server communication through a firewall by routing any type of network traffic to the target server on behalf of the client. This allows the threat actor to bypass any firewalls and then wait for instructions from the C2. AndoryuBot malware supports twelve (12) DDoS attack modes and once communication is established, AndoryuBot is able to receive commands from the C2 server that dictate the target IP address, the DDoS type, and the service or port number to attack. AndoryuBot is a commercial product, and the operators/developers of the botnet advertise that they rent the service out to other threat actors, utilizing cryptocurrency as secure and anonymous payment. AndoryuBot poses a threat to individuals, organizations, and governments, as it could be leveraged by financially motivated and state-sponsored threat actors alike. To prevent exploitation, CTIX analysts urge all Ruckus Wireless customers to ensure their product has the most up-to-date software.