Loading story…
Researchers reported renewed Moobot activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially Tenda routers, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including CVE-2014-8361, CVE-2017-17215, CVE-2018-14558, and CVE-2020-10987. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis.
Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four D-Link router flaws — CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958 — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in UNIX CCTV DVR/NVR devices through port 8000, affecting about 6,000 exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as Moobot_xor and Moobot_leet introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
In early August, Unit 42 observed a campaign exploiting four known D-Link router vulnerabilities to deploy MooBot. The attackers used wget to fetch shell-script droppers and architecture-specific binaries from 159.203.15[.]179.
Manufacturers released patches for the exploited UNIX CCTV DVR/NVR vulnerability, including ALL265 unix 2.3.7.8B09, NVR unix 2.3.7.8B05, and ALL unixip 2.3.4.8B06. The fixes addressed the command injection issue abused by Moobot.
On June 24, 2020, researchers captured a Moobot sample spreading through the UNIX CCTV DVR/NVR command injection vulnerability. The malware used the flaw to drop payloads onto vulnerable devices.
Qihoo 360 and CNCERT observed Moobot scanning TCP port 8000 for a remote command injection zero-day in UNIX CCTV DVR/NVR devices. The flaw abused unchecked NTP server parameters passed to the ntpdate command.
Qihoo 360 and CNCERT reported that in June 2020 they confirmed Moobot was exploiting another zero-day vulnerability, this time against UNIX CCTV DVR/NVR devices. The campaign affected roughly 6,000 internet-exposed devices, most of them in the United States.
From late March 2020 to early May 2020, Moobot's daily attack targets jumped from a few hundred to nearly 20,000. Netlab 360 attributed the spike to attacks against about 48,000 Brazilian IP addresses.
A Moobot variant named Moobot_xor became active in January 2020. Netlab 360 said it remained close to Mirai while changing the registration message and using XOR-based configuration obfuscation with key 0xDEADBEEF.
Netlab 360 reported that it first discovered Moobot, a Mirai-based botnet, in July 2019. The botnet subsequently continued updating its malware, propagating, and conducting DDoS activity.
Alien Labs identified new Moobot botnet infrastructure actively scanning for vulnerabilities in Tenda routers. The activity targeted CVE-2014-8361, CVE-2017-17215, CVE-2018-14558, and CVE-2020-10987.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
otx.alienvault.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.netlab.360.com
Open sourceblog.netlab.360.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2021-36260**, a critical unauthenticated remote code execution flaw in Hikvision IP cameras and NVRs, to compromise exposed devices and install the Mirai-based **Moobot** botnet. The vulnerability stems from improper input validation in the web server’s `language` parameter, allowing command injection without authentication on vulnerable firmware. Public reporting and technical writeups showed the flaw could be used to execute arbitrary commands remotely against internet-facing surveillance systems. Fortinet reported that observed attacks used the flaw to drop a small ARM downloader, retrieve a Moobot payload from `199.195.250[.]233`, and run it as **`macHelper`**. The malware then communicated with the command-and-control domain `life.zerobytes[.]cc`, sent heartbeat traffic, and enabled multiple distributed denial-of-service capabilities, including **SYN**, **UDP**, **ACK**, and **ACK+PUSH** flood attacks. Researchers also linked the activity to a Telegram channel advertising DDoS services, while Hikvision issued patches and defenders published detection and blocking coverage.
Aug 15, 2026
The **Mozi** botnet infected routers, gateways, DVRs, NVRs, and other IoT devices through weak Telnet credentials and known vulnerabilities, then used a **DHT-based peer-to-peer** architecture to spread malware and maintain command-and-control without relying on centralized servers. Researchers said Mozi reused some Gafgyt code but stood apart for its decentralized design, XOR obfuscation, and **`ECDSA384`** signature checks that protected botnet configuration integrity. Infected devices could be directed to launch **DDoS** attacks, download and execute payloads, collect system information, and run arbitrary commands, while compromised nodes also hosted malware for further propagation over HTTP on random ports. Later analysis showed Mozi evolving beyond basic botnet activity by adding persistence mechanisms on **Netgear, Huawei, and ZTE** gateways, including startup-script changes, credential modification, service disabling, and port blocking. Microsoft reported the malware could also support **man-in-the-middle** activity such as DNS spoofing and HTTP session hijacking, raising the risk that compromised edge devices could become entry points into enterprise IT and OT networks. Netlab and other researchers found that even after action against its operators and a slowdown in updates, Mozi’s decentralized network continued to sustain lingering infections, while newer variants added Mirai-style C2 logic for DDoS coordination, UPnP port mapping, and additional node roles tied to mining activity.
Aug 15, 2026
Researchers tracked the Mirai-derived **Echobot** botnet as it rapidly expanded from 18 exploits to 59 and then **71** exploits, broadening propagation across routers, cameras, NAS devices, smart home hubs, servers, SD-WAN appliances, Oracle WebLogic, Barracuda Web Application Firewall, Citrix NetScaler, video conferencing systems, and administration tools. The malware relied heavily on publicly available remote code execution and command-execution exploits, including both legacy flaws dating back to 2003 and newer issues such as **`CVE-2019-15107`** in Webmin, showing how quickly commodity botnet code can be upgraded into large-scale exploit-driven malware. The most notable escalation was Echobot’s move into industrial environments through exploitation of **`CVE-2019-14927`** affecting Mitsubishi Electric remote terminal units, an uncommon step for a Mirai-family botnet toward **SCADA** and critical infrastructure-related devices. Researchers said the malware spread through a bash dropper named **Richard**, which downloaded, compiled, and executed payloads for at least 13 processor architectures, while infrastructure linked to the campaign included open or compromised servers and changing command-and-control domains and ports. The activity underscored Mirai’s continued evolution away from simple default-credential abuse and toward aggressive exploit-based propagation to build larger botnets, likely for **DDoS** operations.
Aug 15, 2026