TheMoon

TheMoon is an IoT-focused malware family and botnet associated primarily with the compromise of consumer and small-office routers, especially Linux-based embedded devices from vendors including Linksys and ASUS. First observed in the wild in 2013 and publicly documented in 2014, it is one of the older router malware families but has continued to evolve through updated variants and renewed operational use.

The malware is known for exploiting exposed router vulnerabilities to gain unauthenticated remote code execution and install architecture-specific payloads on embedded Linux systems. Reported exploitation has included flaws affecting Linksys routers and ASUS routers, with variants tailored to specific vulnerabilities and device families. TheMoon has also been linked to large-scale abuse of compromised routers as proxy infrastructure, including criminal residential proxy services built from infected edge devices.

Once installed, TheMoon can establish and preserve control of infected devices through defensive firewall manipulation. A notable behavior is the installation of iptables rules intended to block competing malware operators and prevent reinfection through the same exposed services. Some variants also open or manage ports needed for botnet communications and use peer-to-peer style message passing to relay registration and tasking information among infected nodes. Documented variants have included modules for time maintenance, network communications, and retrieval and execution of additional payloads.

TheMoon has been observed downloading and executing follow-on components, functioning as a router bot that can receive commands and fetch additional binaries for execution. Communications in at least some analyzed variants were unencrypted, while botnet control relied in part on restricting access at the firewall layer rather than on strong cryptographic authentication. The malware has also been described as continuing to receive updates that improve operational effectiveness and evasion.

The family has been associated with campaigns targeting vulnerable IoT devices broadly, including routers and IP-camera ecosystems, and has been observed competing with other IoT malware families for control of exposed devices. More recently, compromised routers running TheMoon were tied to proxy services such as 5socks, Anyproxy, and infrastructure linked to Faceless, underscoring its role not only as a classic botnet but also as an enabler of covert relay and proxy operations.