The Ballista botnet is exploiting an unpatched TP-Link vulnerability, targeting over 6,000 Archer routers.The botnet spreads automatically using a remote code execution (RCE) flaw.The Ballista botnet has been linked to an Italian-based threat actor.The botnet has affected manufacturing, healthcare, services, and tech sectors in multiple countries.