As many as 4.2 million hosts have been found susceptible to the attacks, including VPN servers, ISP home routers, core internet routers, mobile network gateways, and content delivery network (CDN) ...
The 4 million vulnerable hosts they discovered accept unauthenticated IP in IP (IPIP), Generic Routing Encapsulation (GRE), ...