Condi

The Condi botnet, a form of malware, has been identified as a significant threat to unpatched TP-Link devices. The malware is recognized by the string "condi" and upon execution, sends numerous DNS queries to "trcpay[.]xyz." The botnet first attempts to resolve the Command and Control (C2) server address and function. In addition to this, it has been noted for exploiting the vulnerability CVE-2023-1389 to gain control over devices and execute its malicious activities. This flaw was previously exploited by another botnet known as Mirai Variant - JenX. FortiGuard Labs' analysis in 2023 revealed that the Condi botnet, along with another called Unstable, were utilizing cloud storage and computing services operators to distribute malware payloads and updates to a wide range of devices. FortiGuard had previously disclosed the spread of the Condi DDoS botnet via TP-Link's CVE-2023-1389. Both Condi and Unstable have been under scrutiny for their ability to exploit these vulnerabilities and conduct distributed denial-of-service (DDoS) attacks. A threat actor began advertising the Condi botnet through a "Condi Network" Telegram channel launched in May 2022. The actor monetized the service by offering DDoS attacks and selling the source code for the botnet itself. Furthermore, Fortinet reported in 2023 a DDoS-for-hire service selling website disruptions using Condi, which is also a variant of the Mirai botnet. These developments highlight the increasing sophistication and commercialization of such cyber threats.