MalwareUsed by 1 actor

Masjesu

Masjesu, also referred to as XorBot, is a Mirai-derived IoT botnet used as a DDoS-for-hire service and advertised on Telegram since 2023. It targets a broad range of IoT and embedded devices, including routers, gateways, cameras, DVRs, and NVRs, across multiple CPU architectures. Reported targeted vendors include D-Link, GPON, Huawei, Netgear, TP-Link, Eir, Intelbras, MVPower, Vacron, and Realtek-based devices. It propagates by scanning random IP space for hardcoded open ports and exploiting known command injection and remote code execution vulnerabilities, then downloading and executing payloads; one noted target is port 52869 associated with the Realtek SDK miniigd daemon. The malware is designed for persistence and low visibility: it uses XOR-based encryption/obfuscation for strings, configuration data, payloads, and C2 communications; decrypts critical data at runtime; binds to hard-coded TCP port 55988; daemonizes itself; ignores termination signals; renames itself to resemble legitimate files such as /usr/lib/ld-unix.so.2; spoofs process names such as systemd-journald; installs a cron job every 15 minutes; kills processes including wget, curl, and sshd; and locks down /tmp. It also deliberately avoids sensitive or blocklisted ranges, including U.S. Department of Defense and other U.S. government IP space, to reduce visibility and prolong operations. Masjesu supports multiple DDoS methods, including UDP, TCP, HTTP, VSE, GRE, RDP, OSPF, and ICMP floods, with reported attack capacity around 290 Gbps. It has been promoted for attacks against CDNs, game servers, and enterprises, with observed attack traffic heavily sourced from Vietnam and also from Ukraine, Iran, Brazil, Kenya, and India. Reported infrastructure includes primary C2 85[.]11[.]167[.]182, which served compiled payloads for 17 CPU architectures and exposed a Go-based SSH service on port 1337 and Apache on port 80, as well as related infrastructure 85[.]11[.]167[.]180 (relay[.]hotemail[.]asia) and 45[.]153[.]34[.]252 (blackmirror[.]hotemail[.]asia). The botnet has been linked in reporting to the Telegram handle/channel t.me/flylegit and to the actor name "synmaestro"; one report further attributes Masjesu/XorBot to Seyit Girgin, a Turkish national, based on open-source infrastructure and account correlations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

synmaestro

Called Masjesu, the botnet has been advertised via Telegram as a DDoS-for-hire service since it first surfaced in 2023. It's capable of targeting a wide range of IoT devices, such as routers and gateways, spanning multiple architectures.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

3 techniques

T1583.001DomainsEvidence1

MITRE ATT&CK ID Technique Evidence T1583.001 Acquire Infrastructure: Domains hotemail[.]asia (typosquat), easyfor[.]me, shopanatolia[.]com

T1583.003Virtual Private ServerEvidence1

MITRE ATT&CK ID Technique Evidence T1583.003 Acquire Infrastructure: Virtual Private Server Bulgarian VPS (AS213438) for C2 and stealer hosting

T1584.005BotnetEvidence1

MITRE ATT&CK ID Technique Evidence T1584.005 Compromise Infrastructure: Botnet ~290 Gbps IoT DDoS botnet across 17 architectures

Initial Access

2 techniques

T1133External Remote ServicesEvidence1

Once deployed on a compromised device, the malware moves to create and bind a socket with a hard-coded TCP port (55988) to enable the attacker to connect directly.

T1190Exploit Public-Facing ApplicationEvidence2

Propagation The botnet self-propagates by exploiting known vulnerabilities in consumer and SOHO networking equipment: D-Link routers (multiple CVEs) GPON fiber terminals Huawei home gateways Netgear routers TP-Link routers

Execution

4 techniques

T1053.003CronEvidence1

To achieve persistence, the malware renames itself as a legitimate system file (e.g., /usr/lib/ld-unix.so.2), installs a cron job to run every 15 minutes, and daemonizes to operate silently.

T1059Command and Scripting InterpreterEvidence2

A subsequent iteration of the botnet observed a year later was found to have added 12 different command injection and code execution exploits...

T1059.004Unix ShellEvidence1

MITRE ATT&CK ID Technique Evidence T1059.004 Command and Scripting: Unix Shell iran.sh4 payload delivery script

T1203Exploitation for Client ExecutionEvidence2

Researchers have observed it incorporating multiple command injection and code execution exploits to gain initial access to devices from manufacturers such as D-Link, Huawei, and TP-Link.

Persistence

3 techniques

T1053.003CronEvidence1

To achieve persistence, the malware renames itself as a legitimate system file (e.g., /usr/lib/ld-unix.so.2), installs a cron job to run every 15 minutes, and daemonizes to operate silently.

T1133External Remote ServicesEvidence1

Once deployed on a compromised device, the malware moves to create and bind a socket with a hard-coded TCP port (55988) to enable the attacker to connect directly.

T1547Boot or Logon Autostart ExecutionEvidence1

Otherwise, the malware proceeds to set up persistence, ignore termination-related signals, stop commonly used processes like wget and curl...

Privilege Escalation

2 techniques

T1053.003CronEvidence1

To achieve persistence, the malware renames itself as a legitimate system file (e.g., /usr/lib/ld-unix.so.2), installs a cron job to run every 15 minutes, and daemonizes to operate silently.

T1547Boot or Logon Autostart ExecutionEvidence1

Otherwise, the malware proceeds to set up persistence, ignore termination-related signals, stop commonly used processes like wget and curl...

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence2

It's worth noting that the commercial offering also goes by the moniker XorBot owing to its use of XOR-based encryption to conceal strings, configurations, and payload data.

T1036MasqueradingEvidence1

To achieve persistence, the malware renames itself as a legitimate system file (e.g., /usr/lib/ld-unix.so.2)... It also spoofs process names like systemd-journald to avoid detection.

T1036.005Match Legitimate Resource Name or LocationEvidence1

MITRE ATT&CK ID Technique Evidence T1036.005 Masquerading Botnet binaries mimicking system process names

T1218System Binary Proxy ExecutionEvidence1

Masjesu kills competing processes (wget, curl, sshd) and locks down /tmp to maintain exclusive control.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

Masjesu kills competing processes (wget, curl, sshd) and locks down /tmp to maintain exclusive control.

Discovery

3 techniques

T1046Network Service DiscoveryEvidence3

Once compromised, devices are instructed to connect to a hard-coded port to receive commands for executing attacks and to self-propagate by scanning for vulnerable devices.

T1057Process DiscoveryEvidence1

The malware hides critical data using multi-stage XOR encryption and decrypts it only at runtime, revealing C2 domains and system details.

T1082System Information DiscoveryEvidence1

MITRE ATT&CK ID Technique Evidence T1082 System Information Discovery Honeypot fingerprinting in payloads

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

Once deployed on a compromised device, the malware moves to create and bind a socket with a hard-coded TCP port (55988) to enable the attacker to connect directly.

T1021.004SSHEvidence1

MITRE ATT&CK ID Technique Evidence T1021.004 Remote Services: SSH Go SSH service on port 1337 for bot management

Command and Control

4 techniques

T1008Fallback ChannelsEvidence1

Its C2 setup uses multiple domains and fallback IPs...

T1071Application Layer ProtocolEvidence2

...then connects to an external server to receive DDoS attack commands for executing them against targets of interest.

T1071.001Web ProtocolsEvidence1

Its C2 uses multiple domains with a fallback IP, retrieving commands and payloads via HTTP.

T1105Ingress Tool TransferEvidence1

Upon successful exploitation, the malicious payload is downloaded onto the compromised device.

Impact

4 techniques

T1498Network Denial of ServiceEvidence1

Cybersecurity researchers have lifted the curtain on a stealthy botnet that's designed for distributed denial-of-service (DDoS) attacks.

T1498.001Direct Network FloodEvidence1

MITRE ATT&CK ID Technique Evidence T1498.001 Network Denial of Service: Direct Network Flood UDP, TCP, ICMP, GRE, OSPF floods

T1498.002Reflection AmplificationEvidence1

MITRE ATT&CK ID Technique Evidence T1498.002 Network Denial of Service: Reflection Amplification VSE (Valve Source Engine) amplification

T1499Endpoint Denial of ServiceEvidence2

a stealthy botnet named Masjesu has been identified, operating as a distributed denial-of-service (DDoS) for-hire service.

Other

1 technique

T1562Impair DefensesEvidence2

The bot starts by binding to a fixed TCP port (55988) and hardens itself by ignoring termination signals.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

breakglass intelNews

Apr 11, 2026

From 'Hello Honeypot' to Real Name: Deanonymizing the Masjesu Botnet Operator Through GitHub Commit Emails - Breakglass Intelligence - Breakglass Intelligence

Mirai-derived IoT DDoS botnet that self-propagates across vulnerable consumer and SOHO networking devices, deploys payloads for 17 CPU architectures, uses XOR-encrypted C2 communications, performs honeypot detection, and launches volumetric floods across multiple protocols including UDP, TCP, VSE, GRE, RDP, OSPF, and ICMP.

scworldNews

Apr 9, 2026

Masjesu botnet: Stealthy DDoS-for-hire service targets IoT devices | brief | SC Media

IoT-focused botnet used as a DDoS-for-hire service. It targets routers and gateways across multiple architectures, uses XOR encryption, emphasizes stealth and persistence, exploits command injection and code execution flaws for initial access, and propagates by scanning for vulnerable devices.

security affairsNews

Apr 9, 2026

Masjesu botnet targets IoT devices while evading high-profile networks

A stealthy IoT botnet marketed via Telegram as a DDoS-for-hire service. It targets routers, gateways, and embedded devices across multiple CPU architectures, uses XOR encryption to hide strings/configs/payloads, persists via cron jobs and process masquerading, scans random IPs for vulnerable devices, exploits known flaws in products such as D-Link, GPON, and Netgear, and executes TCP, UDP, and HTTP flood attacks under C2 control.

the hacker newsNews

Apr 8, 2026

Masjesu Botnet Emerges as DDoS-for-Hire Service Targeting Global IoT Devices

An IoT-focused DDoS botnet marketed as a DDoS-for-hire service. It targets routers, gateways, cameras, DVRs, and NVRs across multiple architectures, uses XOR-based encryption to conceal strings/configurations/payloads, establishes persistence, opens a hard-coded TCP port for direct attacker access, kills competing processes like wget and curl, receives DDoS commands from an external server, and self-propagates by scanning random IPs for exploitable services.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.