Multi-Architecture BBNet Linux Botnet Employs Divergent Scanners and Exploits Telnet and React Server Component Vulnerabilities
In November 2026, PRODAFT researchers analyzed a multi-architecture Linux botnet dubbed BBNet, which targets routers, cameras, Telnet services, and React server applications. The botnet package includes 13 ELF binaries compiled for various architectures and employs two distinct scanning mechanisms: a local Telnet scanner on x86-64 and a broader scanner with 11 exploit handlers on other architectures. Notably, BBNet initiates scanning for new victims before connecting to its command-and-control (C2) server, rendering simple C2 blocking ineffective at halting propagation. The botnet exploits known vulnerabilities including CVE-2026-24061 (GNU Inetutils Telnet injection) and CVE-2025-55182 (React Server Components remote code execution). Its scan strategy leverages numerous credential pairs and exploits for multiple device brands such as Hikvision, D-Link, and Huawei. The malware maintains persistence by placing hidden executables and reboot entries on infected hosts without verifying updates cryptographically, and it facilitates several flooding DDoS attack modes via TCP and UDP. Defenders are urged to hunt for .bbnet files in typical directories, audit reboot scripts for unauthorized entries, patch affected software, and disable vulnerable Telnet services to mitigate risk.
Entenda a falha
A vulnerabilidade
BBNet exploits two flaws. CVE-2026-24061 is an argument injection in the GNU Inetutils Telnet daemon through the NEW-ENVIRON option, reachable over the network on exposed Telnet services. CVE-2025-55182 is a remote code execution in React Server Components caused by multipart deserialization. The articles give no CVSS scores, authentication requirements, or affected and fixed versions; they only say to patch both. The botnet also uses exploits for Hikvision, D-Link, Netgear, GPON, Huawei and Realtek devices.
Como funciona
An infected host's scanner (the expanded build uses 24 threads, 45 credential pairs and 11 exploit handlers) sends crafted requests to targets. For Telnet, the request carries a NEW-ENVIRON option that the daemon mishandles through argument injection; for React Server Components, it is a multipart request that gets deserialized on the server. When the target runs the attacker's command, it fetches the loader infect.sh, which downloads all architecture binaries and runs them. The articles do not detail the internals of either vulnerable code path beyond these descriptions.
Por que é vulnerável
The articles describe the root causes only by category: argument injection in the Inetutils Telnet daemon's handling of NEW-ENVIRON input, and unsafe deserialization of multipart data in React Server Components. They do not explain why the flaws went unnoticed or what the fixes change. Separately, BBNet's own HTTP helper counts an exploit as a hit once the request is sent, without checking that the target executed the command, so its hit statistics overstate real infections.
Como foi descoberta
The flaws were not discovered by BBNet's authors in this story; they are known CVEs the botnet uses. PRODAFT's Threat Intelligence team found the BBNet package in November 2026, a 28-file archive recovered from an open server directory, and analyzed it. The articles say the archive held no victim telemetry, so they do not establish how many hosts were infected or how many exploits succeeded. They do not say how the two CVEs were originally found or reported.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No standalone proof of concept is described, but working exploit code for both CVEs is built into the BBNet scanner's 11 exploit handlers, and PRODAFT recovered the binaries from an exposed server directory. This shows the botnet is designed to attack both flaws in the wild. The articles do not say the binaries are published as a repository, so the exploit is treated as not publicly released. Because propagation starts before C2 registration, unpatched Telnet and React Server Components systems should be patched urgently.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 05:15.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2026-24061, CVE-2025-55182. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation
This script targets the telnet daemon in GNU InetUtils 2.0 through 2.6. It abuses the Telnet environment-variable option: the daemon passes an attacker-supplied user name to the login program without sanitising it, so a value shaped like a login option makes login skip the password check and open a root session. The attacker only needs network access to the telnet service (default port 23), with no credentials or user interaction, and a vulnerable build. The code is a short, complete client that negotiates the option and then gives an interactive shell, so it looks like a working exploit. It matches the listed CVE; the 'local' type label in the entry is wrong, since the attack is remote.
-
React Server 19.2.0 - Remote Code Execution
The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.
Detalhes técnicos
The BBNet loader script infect.sh downloads all architecture binaries using varied download tools without CPU checks, running all candidates. The main binary forks into a parent process that registers with a C2 server over TCP and a child scanning process that operates independently beforehand. The x86-64 binary scans local /24 subnet TCP ports 23 and 2323 with 20 credential pairs and SHELL_TEST verification; the other binaries spawn 24 threads, utilize 45 credential pairs, and deploy 11 exploit handlers targeting vulnerabilities across network devices and the two CVEs. The botnet's HTTP helper prematurely marks exploits as hits, potentially overstating success.
Remediação
System administrators should locate and remove .bbnet binaries and state files, audit crontab and rc.local for unauthorized reboot entries, apply patches for CVE-2026-24061 and CVE-2025-55182, and disable exposed Telnet services on Linux and embedded devices. Containment efforts must address the scanner process itself, peer network reachability, and payload distribution to be effective, beyond merely blocking C2 connections.
Linha do tempo
-
Multi-Architecture BBNet Linux Botnet Employs Divergent Scanners and Exploits Telnet and React Server Component Vulnerabilities
ler a análise desta fonte ocultar
In November 2026, PRODAFT researchers analyzed a multi-architecture Linux botnet dubbed BBNet, which targets routers, cameras, Telnet services, and React server applications. The botnet package includes 13 ELF binaries compiled for various architectures and employs two distinct scanning mechanisms: a local Telnet scanner on x86-64 and a broader scanner with 11 exploit handlers on other architectures. Notably, BBNet initiates scanning for new victims before connecting to its command-and-control (C2) server, rendering simple C2 blocking ineffective at halting propagation. The botnet exploits known vulnerabilities including CVE-2026-24061 (GNU Inetutils Telnet injection) and CVE-2025-55182 (React Server Components remote code execution). Its scan strategy leverages numerous credential pairs and exploits for multiple device brands such as Hikvision, D-Link, and Huawei. The malware maintains persistence by placing hidden executables and reboot entries on infected hosts without verifying updates cryptographically, and it facilitates several flooding DDoS attack modes via TCP and UDP. Defenders are urged to hunt for .bbnet files in typical directories, audit reboot scripts for unauthorized entries, patch affected software, and disable vulnerable Telnet services to mitigate risk.
Technical Details
The BBNet loader script infect.sh downloads all architecture binaries using varied download tools without CPU checks, running all candidates. The main binary forks into a parent process that registers with a C2 server over TCP and a child scanning process that operates independently beforehand. The x86-64 binary scans local /24 subnet TCP ports 23 and 2323 with 20 credential pairs and SHELL_TEST verification; the other binaries spawn 24 threads, utilize 45 credential pairs, and deploy 11 exploit handlers targeting vulnerabilities across network devices and the two CVEs. The botnet's HTTP helper prematurely marks exploits as hits, potentially overstating success.
Remediation
System administrators should locate and remove .bbnet binaries and state files, audit crontab and rc.local for unauthorized reboot entries, apply patches for CVE-2026-24061 and CVE-2025-55182, and disable exposed Telnet services on Linux and embedded devices. Containment efforts must address the scanner process itself, peer network reachability, and payload distribution to be effective, beyond merely blocking C2 connections.