Ankura CTIX FLASH Update – April 24, 2026

Malware Activity

When Old Devices and Destructive Malware Become Weapons

A series of recent cyber incidents highlight two growing and related risks: neglected network hardware and destructive malware aimed at disruption rather than profit. In one campaign, a Mirai botnet has been actively exploiting a known flaw in discontinued D‑Link routers, allowing attackers to remotely install malware and quietly turn these outdated devices into tools for large‑scale denial‑of‑service attacks. Although the vulnerability was disclosed more than a year ago, many of these routers remain in use despite no longer receiving security updates, making them easy targets. In a separate but equally concerning trend, a newly discovered wiper malware called Lotus was used in targeted attacks against Venezuela’s energy and utility sector. Unlike ransomware, Lotus is built to permanently destroy systems by wiping hard drives and removing all recovery options after attackers weaken defenses using simple