Loading malware…
Hoaxcalls is an IRC-controlled DDoS botnet malware family derived from Bashlite/Gafgyt and first discovered in April 2020. It compromises network appliances, including routers, IP PBX systems, and web security gateways, through remote code execution vulnerabilities. Its propagation capabilities include scanning for and exploiting DrayTek devices through CVE-2020-8515 and Grandstream UCM devices through CVE-2020-5722. Some variants initiate propagation immediately after execution, while others wait for operator commands. Additional campaigns exploited vulnerabilities in Netlink GPON routers, Zyxel Cloud CNM SecuManager, and Symantec Secure Web Gateway 5.0.2.8. Exploitation of the Symantec vulnerability requires an authenticated session.
Hoaxcalls supports operator-directed UDP, HEX, and DNS floods. Later variants expanded their attack repertoire with HTTP method floods and TCP flag-based floods, including SYN and ACK floods. The malware obfuscates embedded strings with XOR encryption and uses randomized IRC identities for command-and-control communication. Updated variants can proxy traffic through compromised devices, download and execute updates, and maintain persistence across device restarts. They also support disabling watchdog timers to prevent reboots, interfering with Telnet administration, and removing the malware process. Its principal operational purpose is recruiting vulnerable appliances into infrastructure for distributed denial-of-service attacks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
It can propagate by scanning and infecting vulnerable devices using CVE-2020-8515 and CVE-2020-5722 exploits... UCM scan and infect other Grandstream UCM devices by exploiting CVE-2020-5722... Hoaxcalls, a new DDOS botnet, is actively exploiting two vulnerabilities... they are also easily exploited and lead to remote code execution; as such we advise everyone to patch as soon as possible. | Hoaxcalls is a DDoS bot that communicates with its C2 server over IRC. It has various DDoS attack capabilities based on the choice of the C2 operator. Upon reception of a proper C2 command, It can propagate by scanning and infecting vulnerable devices using CVE-2020-8515 and CVE-2020-5722 exploits.
It can propagate by scanning and infecting vulnerable devices using CVE-2020-8515 and CVE-2020-5722 exploits... DRAYTEK scan and infect other Draytek devices by exploiting CVE-2020-8515... Hoaxcalls, a new DDOS botnet, is actively exploiting two vulnerabilities... they are also easily exploited and lead to remote code execution; as such we advise everyone to patch as soon as possible. | Hoaxcalls is a DDoS bot that communicates with its C2 server over IRC. It has various DDoS attack capabilities based on the choice of the C2 operator. Upon reception of a proper C2 command, It can propagate by scanning and infecting vulnerable devices using CVE-2020-8515 and CVE-2020-5722 exploits.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Hoaxcalls is a DDoS bot that communicates with its C2 server over IRC... The bot then connects to its C2 server 178[.]32[.]148[.]5 on TCP port 1337 over IRC. The C2’s IRC channel is #hellroom.
142 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Bashlite/Gafgyt variant mentioned as having exploited the Netlink GPON Router 1.0.11 RCE vulnerability.
A Bashlite/Gafgyt variant previously reported to exploit Netlink GPON Router 1.0.11 RCE, mentioned to contextualize the Mirai variant's use of the same vulnerability.
An offshoot of the Bashlite/Gafgyt family that exploits exposed devices, adds persistence, can proxy traffic, download updates, prevent reboots, and launch multiple DDoS flood types.
IRC-controlled DDoS botnet malware that launches multiple flood attacks and propagates by scanning for and exploiting vulnerable DrayTek and Grandstream UCM devices. Variants either trigger exploitation via C2 flooder commands or automatically begin infecting vulnerable devices on execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.