Loading story…
Microsoft and CUJO AI reported that Zerobot, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak SSH and Telnet credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including CVE-2021-42013 in Apache, CVE-2022-33891 in Apache Spark, Spring4Shell, and F5 BIG-IP flaws. Researchers said the botnet delivered architecture-specific binaries or a zero.sh script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network.
The newer Zerobot 1.1 variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as Mozi, Kaiten, Sora, Phantom, Nbrute, and minerd. Investigators linked activity to infrastructure including the domain zero.sudolite.ml and IP addresses 176.65.137.5 and 176.65.137.6, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CUJO AI published a deeper technical analysis of Zerobot, stating that samples observed earlier used 22 exploit routines targeting 21 listed vulnerabilities. The report also described payload delivery via architecture-specific binaries or zero.sh, attempts to kill competing malware, and efforts to erase shell history.
Microsoft published research detailing Zerobot's evolution as a malware-as-a-service botnet and described the latest tracked version, Zerobot 1.1. The company said the newer version expanded propagation with exploits including CVE-2021-42013 and CVE-2022-33891, added new DDoS methods, and included Linux and Windows-capable samples plus indicators such as zero.sudolite.ml and IPs 176.65.137.5 and 176.65.137.6.
In December 2022, the FBI seized domains associated with DDoS-for-hire services; Microsoft noted that one domain linked to Zerobot activity was reportedly among them. This connected part of Zerobot's infrastructure to broader law-enforcement action against booter services.
At the end of November, CUJO AI Labs publicly reported a new Golang-based botnet named Zerobot. The report described the malware as evolving and abusing numerous recently disclosed vulnerabilities.
CUJO AI Labs observed Zerobot samples in customer networks between November 24 and November 26, marking the malware's initial observed activity in the provided sources. The samples showed a Golang-based botnet targeting routers, firewalls, cameras, web servers, and enterprise software via multiple exploits.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cujo.com
Open sourcemicrosoft.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 15, 2026
The **Mozi** botnet infected routers, gateways, DVRs, NVRs, and other IoT devices through weak Telnet credentials and known vulnerabilities, then used a **DHT-based peer-to-peer** architecture to spread malware and maintain command-and-control without relying on centralized servers. Researchers said Mozi reused some Gafgyt code but stood apart for its decentralized design, XOR obfuscation, and **`ECDSA384`** signature checks that protected botnet configuration integrity. Infected devices could be directed to launch **DDoS** attacks, download and execute payloads, collect system information, and run arbitrary commands, while compromised nodes also hosted malware for further propagation over HTTP on random ports. Later analysis showed Mozi evolving beyond basic botnet activity by adding persistence mechanisms on **Netgear, Huawei, and ZTE** gateways, including startup-script changes, credential modification, service disabling, and port blocking. Microsoft reported the malware could also support **man-in-the-middle** activity such as DNS spoofing and HTTP session hijacking, raising the risk that compromised edge devices could become entry points into enterprise IT and OT networks. Netlab and other researchers found that even after action against its operators and a slowdown in updates, Mozi’s decentralized network continued to sustain lingering infections, while newer variants added Mirai-style C2 logic for DDoS coordination, UPnP port mapping, and additional node roles tied to mining activity.
Aug 15, 2026
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026