Loading malware…
SBIDIOT is a Linux-based IoT botnet malware used for distributed denial-of-service operations. It targets internet-connected embedded systems and has been observed deploying architecture-specific payloads for x86, MIPS, MPSL, and ARM environments. The malware has been linked to exploitation of a remote code execution vulnerability affecting ZTE routers as a propagation mechanism, indicating use against exposed edge and IoT infrastructure.
SBIDIOT is commonly distributed as a packed ELF binary using UPX with modified header values to hinder straightforward unpacking and reverse engineering. In documented samples, the standard UPX magic value was altered so that normal UPX tooling would fail until the header was repaired. This anti-analysis technique is consistent with broader tradecraft seen across Linux IoT malware ecosystems.
Once executed, SBIDIOT operates as a command-and-control driven bot. It connects to a hard-coded controller and processes operator commands associated primarily with network flooding. Supported attack modes include TCP flooding, multiple UDP-based floods, VSE-style traffic generation, and an HTTPSTOMP function that repeatedly issues HTTP requests using randomized user-agent strings. The HTTP-oriented functionality also includes requests intended to interact with Cloudflare challenge paths, suggesting attempts to sustain application-layer flooding against protected targets. The malware also supports process termination commands that kill tracked child processes, enabling operators to stop active attack routines.
Code characteristics reportedly overlap in part with other IoT malware such as Gafgyt, but SBIDIOT is distinguished by its own command set and botnet behavior. Its functionality and targeting place it within the continuing evolution of Linux IoT DDoS malware affecting consumer, enterprise-edge, and industrially connected devices.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
One key technique to stymie reverse engineering botnet code is to obfuscate the code by compressing or encrypting the executable, called packing.
Upon execution, the sample attempts to connect to its C2, which in this case is an IP address and port hard-coded into the binary. | Coupled with some static analysis, this was enough to quickly figure out the protocol and begin interaction. The function responsible for handling commands compares each command received from C2 with one of the following strings: TCP HTTPSTOMP VSE HEX STD VOX NFO UDP UDPH R6 FN OVHKILL NFOKILL STOP Stop stop
STOP/stop/Stop This command sends a SIGKILL signal to all process IDs that are currently being tracked, giving the operator the ability to stop any of the process’ children.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware referenced as also using the Anti-UPX unpacking technique.
IoT malware/botnet referenced as an example of modifying UPX header fields (specifically l_magic) to hinder unpacking and analysis.
IoT-focused DDoS botnet malware that propagates at least in part by exploiting an RCE vulnerability in ZTE routers, downloads architecture-specific payloads, connects to a hard-coded C2 server, and supports multiple flooding commands including TCP, UDP, HTTPSTOMP, VSE, VOX, and stop/kill functionality.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.