Mossad
Mossad is an Internet of Things (IoT) DDoS botnet identified alongside Aisuru, KimWolf, and JackSkid. According to U.S. Department of Justice and related reporting cited in the content, Mossad was part of a cluster of botnets whose command-and-control infrastructure was disrupted in a court-authorized multinational law-enforcement operation in March 2026 involving the United States, Germany, and Canada. The botnet was used to launch distributed denial-of-service attacks against victims worldwide, including attacks targeting IP addresses associated with the U.S. Department of Defense Information Network. The four botnets collectively infected more than 3 million devices worldwide, primarily IoT systems such as routers, Wi‑Fi routers, digital video recorders, web cameras, and IP cameras, and collectively launched hundreds of thousands of DDoS attacks; court documents cited in the content attribute more than 1,000 DDoS attack commands specifically to Mossad. Reporting in the content describes Mossad as a Mirai-variant botnet and notes that it competed with the related botnets for the same pool of vulnerable devices. Infrastructure associated with Mossad included virtual servers, domains, and IP addresses seized by authorities. One source in the content states Mossad has no relation to the Israeli intelligence service, and another attributes its development involvement to a German hacker known as "Snow" or "Lucy," possibly as a solo undertaking, but this attribution appears in reporting rather than official confirmation.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
4 techniques
Resource Development
The disruption itself focused on seizing domains and backend systems used to coordinate the botnets, effectively cutting off the instructions that tell infected devices where and when to send traffic.
Devices infected by the four botnets include digital video recorders, web cameras, Wi-Fi routers and TV boxes.
Command and Control
1 technique
Command and Control
Impact
4 techniques
Impact
The infected devices were enslaved by the botnet operators. The operators then used a “cybercrime as a service” model to sell access to the infected devices to other cyber criminals.
Kimwolf — DDoS-платформой, которую сдавали в аренду «по подписке» другим хакерам... ботнет использовался для проведения более чем 25 000 атак по всему миру... пиковая мощность отдельных атак достигала 31,4 Тбит/с.
Recent activity
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Один из четырех DDoS-ботнетов, чья управляющая инфраструктура была отключена в ходе международной правоохранительной операции. Участвовал в заражении IoT-устройств.
Named as one of several high-impact IoT DDoS botnets disrupted through seizure of command-and-control infrastructure.
An IoT botnet disrupted in the same coordinated law-enforcement operation targeting DDoS botnets. The botnet was reported to have issued over 1,000 attack commands.
A botnet whose command-and-control infrastructure was disrupted alongside Kimwolf, AISURU, and JackSkid in a law enforcement operation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.