Loading story…
The Mozi botnet infected routers, gateways, DVRs, NVRs, and other IoT devices through weak Telnet credentials and known vulnerabilities, then used a DHT-based peer-to-peer architecture to spread malware and maintain command-and-control without relying on centralized servers. Researchers said Mozi reused some Gafgyt code but stood apart for its decentralized design, XOR obfuscation, and ECDSA384 signature checks that protected botnet configuration integrity. Infected devices could be directed to launch DDoS attacks, download and execute payloads, collect system information, and run arbitrary commands, while compromised nodes also hosted malware for further propagation over HTTP on random ports.
Later analysis showed Mozi evolving beyond basic botnet activity by adding persistence mechanisms on Netgear, Huawei, and ZTE gateways, including startup-script changes, credential modification, service disabling, and port blocking. Microsoft reported the malware could also support man-in-the-middle activity such as DNS spoofing and HTTP session hijacking, raising the risk that compromised edge devices could become entry points into enterprise IT and OT networks. Netlab and other researchers found that even after action against its operators and a slowdown in updates, Mozi’s decentralized network continued to sustain lingering infections, while newer variants added Mirai-style C2 logic for DDoS coordination, UPnP port mapping, and additional node roles tied to mining activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
360 Netlab included Mozi in an overview of actively tracked P2P botnets and described it as a DHT-based botnet that began with DDoS-for-profit activity and later added mining. In the sampled period, Mozi ranked behind Pink and Hajime in observed size.
Elastic Security Labs published a case study on collecting and operationalizing Mozi intelligence from open sources, including ThreatFox and Malware Bazaar. The analysis described repairing Mozi's corrupted UPX header, extracting DHT and firewall indicators, and visualizing globally distributed activity across at least 24 countries.
QiAnxin and Sangfor published reports describing WorkMiner as a mining trojan that spreads through weak SSH passwords and exhibits P2P behavior. Later analysis linked WorkMiner to the Mozi ecosystem as the Mozi_ssh node type.
360 Netlab reported newly identified Mozi node types, including Mozi_ftp and Mozi_ssh, both mining trojans that propagate via weak credentials while participating in the same Mozi P2P network. The report said shared XOR keys and configuration-signing public keys indicated they likely came from the same author as Mozi_bot.
360 Netlab stated that Mozi's authors had been taken into custody by law enforcement agencies and that it had provided technical assistance during the action. The same report noted that lingering infected devices could continue spreading because of Mozi's decentralized P2P design.
Microsoft researchers reported that Mozi had evolved persistence techniques for Netgear, Huawei, and ZTE gateways and added man-in-the-middle capabilities such as DNS spoofing and HTTP hijacking. The report highlighted the risk that compromised gateways could provide initial access into enterprise IT and OT environments.
Backend statistics observed in September 2020 showed reporting entries beyond standard Mozi_bot nodes. This later supported identification of additional Mozi roles such as Mozi_ftp and Mozi_ssh within the same P2P ecosystem.
360 Netlab published research describing Mozi as a DHT-based peer-to-peer IoT botnet that spreads via weak Telnet credentials and multiple known device vulnerabilities. The report documented its propagation methods, configuration system, and botnet capabilities including DDoS and payload execution.
360 Netlab identified a suspicious malware sample on September 3, 2019 that many VirusTotal engines initially flagged as Gafgyt. The researchers later determined it was a distinct botnet they named Mozi.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
blog.netlab.360.com
Open sourceelastic.co
Open sourceblog.netlab.360.com
Open sourcemicrosoft.com
Open sourcecujo.com
Open sourceblog.netlab.360.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 15, 2026
Microsoft and CUJO AI reported that **Zerobot**, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak `SSH` and `Telnet` credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including `CVE-2021-42013` in Apache, `CVE-2022-33891` in Apache Spark, **Spring4Shell**, and **F5 BIG-IP** flaws. Researchers said the botnet delivered architecture-specific binaries or a `zero.sh` script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network. The newer **Zerobot 1.1** variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as **Mozi**, **Kaiten**, **Sora**, **Phantom**, **Nbrute**, and `minerd`. Investigators linked activity to infrastructure including the domain `zero.sudolite.ml` and IP addresses `176.65.137.5` and `176.65.137.6`, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Aug 15, 2026
The **Momentum botnet** was observed compromising Linux-based internet-facing devices and using them to launch distributed denial-of-service attacks, with infections spanning routers, DVRs, web servers, GPON equipment, and other exposed services. Trend Micro reported that the malware targeted multiple CPU architectures, established persistence by modifying `rc` files, connected to IRC command-and-control infrastructure including the `#HellRoom` channel, and in one analyzed case deployed a **Mirai** backdoor while also using **Kaiten** and **Bashlite** variants in its broader operations. The activity was tied to exploitation of known router remote-code-execution weaknesses, including publicly disclosed flaws affecting **ZyXEL**, **Billion**, and **TrueOnline** devices, helping the operators expand a botnet that reportedly showed **1,232 victims** on an observed C2 server. Once enrolled, infected systems could be directed to carry out **36** attack methods, including `SYN`, `ACK`, `UDP`, `HTTP`, `LDAP`, `DNS`, `Memcache`, and Valve Source Engine amplification floods, while also supporting proxying, shell-command execution, and fast-flux techniques to keep command infrastructure resilient.
Aug 14, 2026