Security researchers stated in a new report that they have observed a sharp uptick in the exploitation of a years old remote code execution (RCE) vulnerability affecting the Realtek Jungle SDK. Realtek Jungle chipsets have become a staple in hundreds of routers, switches, and other IoT devices used by supply-chain organizations across the world. Only days after the flaw was originally disclosed in August 2021, researchers and security personnel observed as many as 1 million vulnerable devices being attacked at one time. By December 2022, researchers stated they observed approximately 134 million exploitation attempts, and that the attack is still ongoing. The vulnerability, tracked as CVE-2021-35394 (CVSS 9.8/10), is a combination of memory corruption and command injection flaws in a Realtek Jungle SDK diagnostic tool called “MP Daemon”, and compiled as a “UDPServer” binary. The exploitation of this vulnerability is being leveraged by multiple malicious botnet variants, mainly Mirai, Gafgyt, Mozi, and derivatives of them, as well as a new GO-based botnet known as “RedGoBot”, leveraged in distributed denial-of-service (DDoS) attacks. These botnets have been observed delivering three (3) different malware payloads. Supply-chain vulnerabilities pose an especially lucrative opportunity for threat actors, and the nature of the supply chain itself often leaves it very vulnerable. This flaw was patched in August 2021; however, depending on the organization’s part in the supply chain, shutting down operations to update their infrastructure could cause a critical loss to business or even threaten national security. CTIX analysts urge any administrators responsible for vulnerable infrastructure to begin developing a plan for patching this flaw that will impact operations the least, through rolling updates where the organization is patched piece-by-piece. The exploitation of this flaw is expected to stay high throughout the beginning of 2023, and CTIX analysts will continue to monitor this campaign.