The Gayfemboy botnet has been exploiting a vulnerability in Four-Faith industrial routers since November 2024 to launch DDoS attacks. This botnet variant, using the Mirai codebase, has integrated N-day and 0-day exploits and has been attacking with over 15,000 daily active nodes. The attacks have targeted various global entities including the U.S and China and have resulted in blackholing traffic and disabling services due to the overwhelming network resources consumed by DDoS. The botnet targets several vulnerabilities across different devices and has disrupted not only Four-Faith routers but also affected other devices like Neterbit routers and Vimar smart home devices. The severity of this attack is predominantly on network resources, causing significant disruption.

The Gayfemboy botnet has been aggressively exploiting a vulnerability, designated CVE-2024-12856, in Four-Faith industrial routers, as well as other devices like Neterbit routers and Vimar smart home devices. This botnet has facilitated widespread DDoS attacks that peaked in October and November. The concentration of botnet activity has resulted in substantial disruptions across various regions, with a significant portion of the infected nodes localized in China, the United States, Iran, Russia, and Turkey. The attacks, which leveraged several N-day and 0-day vulnerabilities, have not only impaired services but also raised concerns about the long-term security implications for affected devices and networks.