A botnet made up of servers and smart devices has begun the mass exploitation of a severe Drupal CMS vulnerability. Netlab researchers, along with experts from GreyNoise Intelligence, have spotted the shift in this botnet’s activity from various other exploits to the Drupalgeddon 2 vulnerability at the start of the week. Muhstik is built on top of Tsunami, a very old strain of malware that has been used for years to create botnets by infecting Linux servers and devices running Linux-based firmware.
Source: https://www.bleepingcomputer.com/news/security/big-iot-botnet-starts-large-scale-exploitation-of-drupalgeddon-2-vulnerability/