“EwDoor”, a recently discovered botnet, has been identified targeting unpatched AT&T EdgeMarc Enterprise Session Border Controller (ESBC) network edge devices. EwDoor is observed exploiting the Blind Command Injection vulnerability CVE-2017-6079, which is a four (4) year-old critical severity flaw. Researchers at 360 Netlab, aka Qihoo 360’s Network Security Research Lab, identified the botnet in late October 2021 and concluded that, during their three (3) hour observation period, the botnet had approximately 5,700 active victims all located in the United States. Researchers stated that EwDoor’s “main purpose is DDoS attacks, and gathering of sensitive information, such as call logs” as well as “its main functions can be summarized into 2 main categories of DDoS attacks and Backdoor”. 360 Netlab captured three (3) versions of the EwDoor botnet and observed six (6) major functions: port scanning, self-updating, file management, reverse SHELL, execute arbitrary commands, and DDoS attack. An in-depth technical analysis and indicators of compromise (IOCs) can be reviewed in 360 Netlab’s report, linked below.