0cl

0cl is a self-identified botnet operator associated with a Mirai-derived malware operation internally known as boatnet. The operation compromises Linux systems through exposed Docker APIs and exploitation of routers, IP cameras, and other IoT devices. Its malware supports numerous processor architectures and provides HTTP application-layer distributed denial-of-service capabilities, including rotating browser user-agent strings and language headers. No geographic origin, specific victim countries or industries, or nation-state affiliation has been established. Docker-based delivery creates privileged containers with access to the host filesystem and host networking, then downloads and executes shell-based payloads. Other delivery mechanisms exploit Huawei home gateways, Hi3510-based cameras, Tenda and D-Link routers, and vulnerable CGI interfaces. Persistence mechanisms include scheduled tasks, boot-script modifications, systemd services, and filesystem links. The malware also attempts to make its executable immutable and suppresses hardware watchdog behavior. The operator's malware uses a competitor-removal module that examines running processes and compares executable SHA-256 hashes against 11 hardcoded fingerprints, allowing rival malware to be terminated despite filename changes. A process whitelist preserves essential operating-system, container, Android, and cellular-modem management services. Defense-evasion techniques include UPX packing, encoded strings, runtime construction of command-and-control addresses, anti-debugging, kernel-thread impersonation, and deletion of the executable after launch. Host operating-system fingerprinting supports reconnaissance. Attribution to 0cl is supported by distinctive operator-identifying log prefixes, matching payload naming conventions, and the shared competitor-hash list across analyzed builds.