Loading story…
The Muhstik botnet was observed actively exploiting the critical Drupal remote code execution flaw CVE-2018-7600 (also known as Drupalgeddon 2) across Drupal 6, 7, and 8 sites, using vulnerable URLs to inject commands and take control of exposed servers. Researchers said exploitation accelerated soon after Drupal released patches, with large-scale scanning beginning in mid-April and multiple threat groups targeting the bug; one cluster tied to Muhstik showed worm-like propagation behavior and put more than a million potentially exposed sites at risk.
Netlab 360 linked the activity to a long-running Tsunami variant that used multi-architecture payloads, IRC-based command-and-control on port 9090, and hard-coded infrastructure and channels prefixed with muhstik. Once installed, the malware deployed miners including XMRig and CGMiner, launched DDoS attacks, stole SSH credentials, attempted SSH brute-force propagation, and used a scanning module to probe Drupal and at least six other internet-facing vulnerabilities or misconfigurations while reporting successful compromises back to attacker-controlled servers.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
360Netlab intercepted multiple Muhstik DDoS attack instructions targeting IP address 46.243.189.102. The commands showed the botnet being used operationally for denial-of-service activity in addition to mining and propagation.
360Netlab observed a Muhstik command-and-control server issuing commands to deliver the aiox86 scanning module. The module was used to exploit Drupal and additional web-facing vulnerabilities across multiple ports.
360Netlab observed a large number of internet scans targeting CVE-2018-7600. The activity marked the beginning of broad exploitation attempts against vulnerable Drupal servers.
MITRE's CVE bulletin warned that CVE-2018-7600 could lead to complete compromise of a Drupal site. This underscored the severity of the vulnerability shortly after disclosure.
Drupal released a patch for the critical remote code execution vulnerability CVE-2018-7600, which affected Drupal 6, 7, and 8. The flaw could allow attackers to take full control of vulnerable sites.
360Netlab attributed one major exploitation campaign against CVE-2018-7600 to a botnet it named Muhstik, a Tsunami variant with worm-like propagation. The researchers said at least three malware groups were exploiting the Drupal flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 62 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named `XMI` and a Python script named `d.py` to download payloads, establish persistence, and spread further, with the miner identified as **Coinminer.Linux.MALXMR.UWELD** and the bot as a Kaiten/Tsunami variant detected as **Backdoor.Linux.KAITEN.AMV**. The malware relied on Base64 obfuscation, cron jobs, and a service placed in `/etc/init.d` for persistence, and it attempted lateral movement by harvesting targets from `/.ssh/known_hosts`; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting `CVE-2019-3396` and `CVE-2017-5638`, previously associated in public reporting with the **8220** mining group, while the DDoS component communicated with command-and-control infrastructure including `c4k[.]xpl[.]pwndns[.]pw`, `104[.]244[.]75[.]25`, and `107[.]189[.]11[.]170`.
Aug 14, 2026
Attackers rapidly weaponized **Atlassian Confluence** vulnerability `CVE-2021-26084`, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the **z0Miner** botnet, which had previously spread through **WebLogic, Elasticsearch, and Jenkins** flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed **XMRig** miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts. Security researchers also observed broader exploitation beyond z0Miner, including **Muhstik**, **Sysrv-Hello**, **Setag**, **BillGates**, and **Dofloo**-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port `23733`. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.
Aug 14, 2026
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the **Smominru** operation, a Monero cryptomining botnet that infected more than **526,000 Windows hosts**—likely many of them servers—primarily through the `EternalBlue` SMB flaw (`CVE-2017-0144`), with indications of additional use of `EsteemAudit` (`CVE-2017-0176`) and attacks via SQL Server. The operators were estimated to have mined about **8,900 Monero**, worth roughly **$2.8 million to $3.6 million** at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining. Separate research highlighted a **Mirai** spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Aug 15, 2026