INTEL_REPORT
Palo Alto Networks Unit 42 · published 4/16/2026, 10:00:13 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
A Deep Dive Into Attempted Exploitation of CVE-2023-33538 CVE-2023-33538 allows for command injection in TP-Link routers. We discuss exploitation attempts with payloads characteristic of Mirai botnet malware. The post A Deep Dive Into Attempted Exploitation of CVE-2023-33538 appeared first on Unit 42 . A Deep Dive Into Attempted Exploitation of CVE-2023-33538 Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Threat Research Vulnerabilities V…
https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538
sha256:83d37dfb2356100216be9f12ddf88a7989c783057681572ab1b7cca39d9f776f
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| Open → |
| cve | CVE-2025-0921 | Open → |
| cve | CVE-2025-14847 | Open → |
| cve | CVE-2025-23304 | Open → |
| cve | CVE-2026-22584 | Open → |
| cve | CVE-2025-55182 | Open → |
| cve | CVE-2025-66478 | Open → |
| ip | 51.38.137.113 | Open → |
| domain | wlannetworkrpm.htm | Open → |
| domain | top1hbt.arm | Open → |
| domain | top1hbt.mips | Open → |
| domain | cnc.vietdediserver.shop | Open → |
| domain | index.htm | Open → |
| domain | loginrpm.htm | Open → |
| domain | bot.ddosvps.cc | Open → |
| domain | top1hbt.mpsl | Open → |
| sha256 | 3fbd2a2e82ceb5e91eadbad02cb45ac618324da9b1895d81ebe7de765dca30e7 | Open → |
| sha256 | 4caaa18982cd4056fead54b98d57f9a2a1ddd654cf19a7ba2366dfadbd6033da | Open → |
| sha256 | 9df711c3aef2bba17b622ddfd955452f8d8eb55899528fbc13d9540c52f13402 | Open → |
| sha256 | 7bbb21fec19512d932b7a92652ed0c8f0fedea89f34b9d6f267cf39de0eb9b20 | Open → |
| sha256 | 00078aeeaca54b5d3c1237e964e9f956690b782e4ea160d81edc3c6b44e7f620 | Open → |
| sha256 | 534b654531a6a540a144da9545ee343e1046f843d7de4c1091b46c3ee66a508b | Open → |
| sha256 | 919f292a07a37f163f88527e725406187c8ecc637387ad24853fe49ce4e6ddf4 | Open → |
| sha256 | c321933e4e5970ba7299fe21778dab9398994c22ca0ba0422c6cbc3fbb95ea26 | Open → |
| sha256 | 56f21f412e898ad9e3ee05d5f44c44d9d7bcb9ecbfbdb9de11b8fa5a637aeef6 | Open → |