MooBot
MooBot is an IoT botnet malware family and Mirai variant used to compromise internet-exposed edge and embedded devices, especially routers and DVRs, and conscript them into botnets for DDoS activity and proxying malicious traffic. The content links MooBot to infections of Ubiquiti EdgeOS routers, TP-Link Archer AX21 routers, Hikvision devices via CVE-2021-36260, Cacti servers via CVE-2022-46169, and LILIN DVR devices via a 0-day vulnerability chain. Reported propagation and exploitation vectors include default administrator passwords on exposed Ubiquiti routers, CVE-2023-1389 command injection on TP-Link Archer AX21 devices, CVE-2021-36260, exploitation of Cacti to deliver botnet payloads, and LILIN DVR command injection and file-read flaws. Fortinet reporting cited MooBot fetching and executing scripts that download architecture-specific ELF payloads and then remove traces. One protocol-level indicator mentioned in the content is that the initial registration packet may contain the bytes \x33\x66\x99, noted as commonly associated with MooBot and another Mirai variant.
Operationally, MooBot has been observed in botnet-based DDoS activity alongside Mirai, Gafgyt, IRCBot, and RipprBot, including attacks observed during the Russia-Ukraine conflict. The content also states that Russia’s GRU Unit 26165, tracked as APT28, Fancy Bear, Sednit, and Forest Blizzard, repurposed a criminal MooBot botnet in April 2022 after seizing control of hundreds of compromised Ubiquiti EdgeRouters. In that state-linked use, the MooBot-based router infrastructure was used to relay stolen authentication hashes toward Microsoft Exchange, host phishing landing pages and credential proxies on residential IP space, run custom Python scripts for webmail credential theft, steal NTLMv2 digests, and redirect phishing traffic via custom routing rules. Victims and targets associated with this GRU use included U.S. and foreign governments, military entities, security organizations, corporate organizations, and broader cyberespionage targets in the United States and allied countries.
Law enforcement disrupted this infrastructure in February 2024 through the FBI’s Operation Dying Ember, which targeted hundreds of compromised Ubiquiti EdgeOS routers, deleted MooBot and related malicious files, and temporarily blocked attacker remote access. The content also references MooBot infrastructure and indicators including a MooBot C2 endpoint at wor.wordtheminer.com:8725 and infrastructure such as 185.224.129.233 and goodpackets.cc in DDoS reporting.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The botnet was originally built by criminals using the MooBot malware. APT28 used it over in April 2022 and included the botnet into three distinct uses.
The botnet is likely using CVE-2021-36260 to infect these targets... VulnCheck tracks 23 public exploits for this vulnerability, including a Metasploit module... included in CISA’s Known Exploited Vulnerabilities Catalog (KEV)... actively detected in the Shadow Server and GreyNoise honeypot networks.
Tracked as CVE-2023-1389, the flaw is a high-severity unauthenticated command injection problem in the locale API reachable through the TP-Link Archer AX21 web management interface. | Recently, we observed multiple attacks focusing on this year-old vulnerability, spotlighting botnets like Moobot, Miori, the Golang-based agent "AGoent," and the Gafgyt Variant.
"...allowing threat actors to breach internet-exposed Cacti servers to deliver botnet malware such as MooBot and ShellBot."
...there remain a lot of affected devices on the internet, which is somewhat surprising given years of exploitation by at least one botnet (Moobot).
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The botnet was originally built by criminals using the MooBot malware. APT28 used it over in April 2022 and included the botnet into three distinct uses.
For instance, in February 2024, the FBI took down Moobot, a botnet of hacked Ubiquiti Edge OS routers used by Russia's Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic in cyberespionage attacks targeting the United States and its allies.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
3 techniques
Initial Access
Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
Mirai variant: Downloads a script that subsequently fetches ELF files, which are compressed using UPX. Monitors and terminates packet analysis tools to avoid detection.
Defense Impairment
1 technique
Defense Impairment
Credential Access
3 techniques
Credential Access
Collection
1 technique
Collection
Command and Control
5 techniques
Command and Control
The binary protocol used by Condi to communicate with the C2 server is a modified version of that initially implemented in Mirai.
Hosting phishing landing pages and credential-collection proxies on residential IPs, which sat below the radar of most reputation-based filtering.
SocksEscort was a front for a malware operation that infected modems and home routers... most of which were other cybercrime operations needing ways to hide their attacks inside the infrastructure of residential internet providers.
IOCs tracked for this family
53 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used to build a criminal botnet that compromised routers and was later repurposed by APT28 for relaying stolen authentication hashes, hosting phishing pages, and running custom Python scripts on hijacked routers.
Router-focused malware used to build a botnet of compromised edge devices that APT28 leveraged for relay, phishing hosting, and credential collection support.
A botnet that used compromised Ubiquiti routers for malicious activity.
A botnet of compromised Ubiquiti Edge OS routers used to proxy malicious traffic and conceal cyberespionage operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.