Alert: 6,000+ TP-Link Routers Under Attack by Ballista Botnet Exploiting Unpatched Vulnerability

A new botnet called "Ballista" is targeting vulnerable TP-Link Archer routers by exploiting CVE-2023-1389, a remote code execution vulnerability. Active since January 2025, the malware establishes encrypted C2 communication to execute commands, launch DoS attacks, and spread to other devic...