Campaign, Aug 2023 to Aug 2025.View on attack.mitre.org
Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. The botnet was initially composed primarily of TP-Link routers and was named Quad7 due to compromised devices exposing TCP port 7777 with the distinctive banner xlogin. Later activity showed a significant increase in compromised Asus routers and the addition of new ports and banners, including TCP port 63256 displaying alogin. Quad7 infrastructure functions as a collection of egress IPs that various China-affiliated threat actors have used to conduct password-spraying and brute-force operations. Microsoft has reported that Storm-0940 leveraged credentials obtained through Quad7 Activity to target organizations in North America and Europe, including government agencies, non-governmental organizations, think tanks, law firms, energy firms, IT providers, and defense industrial base entities.
| Technique | Procedure example |
|---|---|
| T1027.011 Fileless Storage |
Quad7 Activity has infected victim network devices by storing artifacts in the |
| T1059.004 Unix Shell |
Quad7 Activity has enabled the creation of an access-controlled command shell |
| T1071.001 Web Protocols |
Quad7 Activity has used the same User Agents of |
| T1071.002 File Transfer Protocols |
Quad7 Activity has used a File Transfer Protocol (FTP) server to download malicious binaries. |
| T1090.002 External Proxy |
Quad7 Activity has initialized SOCKS5 proxies on compromised devices. |
| T1090.003 Multi-hop Proxy |
Quad7 Activity has routed traffic through chains of compromised network devices for password spray attacks. |
| T1105 Ingress Tool Transfer |
Quad7 Activity has downloaded additional binaries from a remote File Transfer Protocol (FTP) server to compromised devices. |
| T1110.003 Password Spraying |
Quad7 Activity has conducted a throttled variant of password spraying techniques that only utilized a single attempt to sign in within a 24-hour time period, eluding brute force detection thresholds. |
| T1190 Exploit Public-Facing Application |
Quad7 Activity has enabled the exploitation of vulnerabilities for remote code execution capabilities in SOHO routers including CVE-2023-50224 and CVE-2025-9377 in TP-Link devices. |
| T1571 Non-Standard Port |
Quad7 Activity has used non-standard TCP ports – such as 7777, 11288, 63256, 63210, 3256, and 3556 for C2. |
| T1584.005 Botnet |
Quad7 Activity has compromised various branded SOHO routers to form a botnet that has been leveraged in password spraying activity. |
| T1584.008 Network Devices |
Quad7 Activity has compromised network devices, such as IP cameras, Network Attached Storage (NAS) devices, and SOHO routers, to leverage for follow-on activity. |
| T1589.002 Email Addresses |
Quad7 Activity has gathered targeted individual’s e-mail addresses for the password spraying attempts. |
| T1665 Hide Infrastructure |
Quad7 Activity has rotated the compromised SOHO IPs used in password spraying activity to hamper detection and network blocking activities by defenders. |
| T1685 Disable or Modify Tools |
Quad7 Activity has disabled the TP-Link management interface for TP-Link by killing the |
MITRE does not attribute this campaign to a group.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
