TP-Link routers targeted by state-sponsored hackers with custom malware implant.

Chinese state-sponsored hacking group "Camaro Dragon" has infected TP-Link routers with a custom "Horse Shell" malware to attack European foreign affairs organizations. The malware is deployed in a custom and malicious firmware designed specifically for TP-Link routers, allowing the hackers to launch attacks appearing to originate from residential networks. The deployed malware allows the threat actors full access to the device, including running shell commands, uploading and downloading files, and using it as a SOCKS proxy to relay communication between devices. Users are advised to apply the latest firmware update for their router model to patch any existing vulnerabilities and change the default admin password to something strong.