Zerobot now targets Tenda routers and n8n servers to spread Mirai-style malware

Zerobot is back, and this time it is going after both consumer networking gear and business automation servers. Akamai said on February 27 that its SIRT team observed active exploitation of CVE-2025-7544 in Tenda AC1206 routers and CVE-2025-68613 in the n8n workflow platform, with the attacks used to fetch a shell script named tol.sh and then load a Mirai-based payload Akamai calls zerobotv9. Akamai says it first saw the activity in its honeypots in January 2026, although the broader campaign appears to date back to at least December 2025.

The headline risk is simple. A threat actor can use these bugs to turn exposed devices and servers into malware download points. That matters even more for n8n because, unlike a home router, an n8n server often sits close to databases, APIs, and internal systems. Akamai says that makes n8n targeting more dangerous than a typical IoT botnet hit because a successful compromise could help an attacker move deeper into an organization.

One important correction to the sample article: not both flaws are command injection bugs. NVD describes CVE-2025-7544 in the Tenda AC1206 as a stack-based buffer overflow in /goform/setMacFilterCfg via the deviceList parameter. The n8n issue, by contrast, is a critical remote code execution flaw in workflow expression evaluation.

What Akamai says Zerobot is exploiting

Akamai says the Tenda exploit chain used about 500 A characters in the deviceList parameter to trigger the flaw, then ran commands that downloaded tol.sh from 144.172.100.228. It observed the same general goal with the n8n exploit, which also fetched and executed tol.sh before pulling in the main botnet payload.

From there, the campaign looks like a classic Mirai-style spreader with a few newer touches. Akamai says tol.sh copies BusyBox into /tmp, downloads architecture-specific Zerobot binaries, and executes them across multiple CPU types. The researchers also found a hard-coded command-and-control domain, 0bot.qzz[.]io, inside the payload.

Why this Zerobot wave stands out

The Tenda side fits the usual botnet playbook. The n8n side does not. GitHub’s own advisory says the n8n bug can lead to full compromise of the instance, including access to sensitive data, workflow changes, and system-level operations. In other words, if a botnet operator finds an exposed and vulnerable n8n server, they are not just hijacking a simple appliance. They may gain a foothold on a server tied to business processes and internal credentials.

Akamai also says this version of Zerobot differs from the original 2022 strain. The new zerobotv9 sample is smaller, packed with UPX, includes encrypted strings, and is not written in Go like the first version Fortinet described in 2022. Akamai also says the malware now carries extra attack methods such as TCPXmas, Mixamp, SSH, and Discord, which suggests the operators have kept evolving the toolkit rather than simply recycling an older build.

Infection flow at a glance

• Attacker finds an exposed Tenda AC1206 router or vulnerable n8n instance.
• The exploit runs shell commands that fetch tol.sh from attacker-controlled infrastructure.
• tol.sh downloads architecture-specific Mirai payloads and executes them.
• The infected device or server joins the botnet and can receive commands through 0bot.qzz[.]io.

What defenders should do now

FAQ