When Old Devices and Destructive Malware Become Weapons

A series of recent cyber incidents highlight two growing and related risks: neglected network hardware and destructive malware aimed at disruption rather than profit. In one campaign, a Mirai botnet has been actively exploiting a known flaw in discontinued D‑Link routers, allowing attackers to remotely install malware and quietly turn these outdated devices into tools for large‑scale denial‑of‑service attacks. Although the vulnerability was disclosed more than a year ago, many of these routers remain in use despite no longer receiving security updates, making them easy targets. In a separate but equally concerning trend, a newly discovered wiper malware called Lotus was used in targeted attacks against Venezuela’s energy and utility sector. Unlike ransomware, Lotus is built to permanently destroy systems by wiping hard drives and removing all recovery options after attackers weaken defenses using simple scripts. Together, these incidents show how unpatched technology and purpose‑built destructive malware are increasingly being leveraged for disruption, especially against critical infrastructure, underscoring the importance of timely device replacement, strong defenses, and reliable offline backups. CTIX analyst will continue to report on the latest malware strains and attack methodologies.