Mossad
Mossad is a Mirai-variant botnet, not related to the Israeli intelligence service, that was disrupted in a coordinated March 2026 law enforcement operation alongside the Aisuru, KimWolf, and JackSkid botnets. The operation, led by the U.S. Department of Justice with support from U.S., Canadian, and German authorities and private-sector partners, seized domains, virtual servers, IP addresses, and other command-and-control infrastructure associated with the botnet. The botnet was used for distributed denial-of-service attacks and formed part of a broader cybercrime-as-a-service ecosystem in which operators rented attack capability and proxy services to other criminals. Reporting in the provided content states that Mossad issued approximately 1,000 DDoS attack commands. Like the other botnets disrupted in the same action, it contributed to the compromise of internet-connected devices at scale, including IoT infrastructure such as routers, digital video recorders, security cameras, and related devices. The content attributes Mossad’s development to the involvement of a young German hacker known as "Snow" or "Lucy," possibly named Philip, and assesses that Mossad appears to have been a solo project by that individual. The content also notes that KimWolf, Aisuru, and Mossad were created with that hacker’s involvement. Mossad is described as part of the Mirai malware family and associated with the same criminal botnet ecosystem as Aisuru and KimWolf.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇮🇷 Iran
Where they're from
Attributed origin per open-source reporting.
- IL
Tradecraft
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named botnet network disrupted by the US Department of Justice.
Botnet used in large-scale DDoS attacks and operated as part of a rentable attack-for-hire ecosystem.
Botnet operation involved in DDoS activity; the content says Mossad was responsible for about 1,000 DDoS attacks.
Botnet involved in distributed-denial-of-service attacks using infected Internet-of-Things devices worldwide.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.