muhstik

Muhstik is a botnet and malware family assessed as a variant of Tsunami that has been active since at least 2016 and is associated with opportunistic exploitation of internet-exposed systems. It has been observed exploiting multiple public vulnerabilities and misconfigurations in web-facing services, including Drupal CVE-2018-7600 and Atlassian Confluence CVE-2021-26084, and using worm-like propagation to expand infections. Muhstik has employed multi-architecture payload delivery, internet-wide scanning, and modular propagation components to compromise additional hosts. Operationally, Muhstik has used IRC-based command and control, with separate channels supporting different functions and architectures. Observed capabilities include reconnaissance and scanning for vulnerable services, initial access through exploitation of public-facing applications, SSH brute-force activity, credential theft targeting local SSH credentials, lateral movement via SSH-based propagation, persistence through deployment of follow-on tooling, defense evasion, post-exploitation tasking, cryptocurrency mining, and distributed denial-of-service attacks. Reported operator commands have included deployment of scanning modules, checks for vulnerable applications, miner installation, SSH propagation, and DDoS execution. Muhstik has targeted a broad set of exposed technologies rather than a narrowly defined victim vertical, including content management systems, middleware, web administration surfaces, and Redis- or Confluence-adjacent server environments where exploitation opportunities existed. It has been linked to monetization through cryptomining, including use of XMRig and cgminer, and to botnet-style disruptive activity through DDoS. The actor is best characterized as a financially motivated opportunistic botnet operator rather than a nation-state intrusion set.