Necro Python Botnet Expanded Exploitation and Monero Mining Across Linux and Windows

Researchers reported that the Necro botnet—also tracked as N3Cr0m0rPh, FreakOut, and Necromorph—rapidly evolved from an older Python malware family into an active cross-platform campaign targeting both Linux and Windows systems. Multiple reports tied the operation to exploitation of public-facing flaws including CVE-2020-28188, CVE-2021-3007, and CVE-2020-7961, with later variants adding more n-day exploits such as those affecting TerraMaster, Genexis, Xinuos OpenServer, Zeroshell, and Visual Tools DVR VX16 4.2.28.0. The malware also spread through SSH and Telnet brute forcing, and researchers observed infection volumes ranging from hundreds of confirmed download attempts to estimates in the tens of thousands of compromised hosts.

The botnet used IRC-based command and control, later strengthened with DGA-generated domains, Tor, SSL-encrypted communications, polymorphic code, and PyInstaller-packed binaries to improve resilience and execution. Once installed, Necro enabled DDoS attacks, reverse shells, persistence, traffic sniffing, ARP poisoning, lateral movement, file infection, and JavaScript injection, while monetizing access primarily through XMRig-based Monero mining and, in some cases, Tezos mining. Cisco Talos also observed a Windows user-mode rootkit and a one-off apparent ransomware delivery attempt, underscoring that the operators were actively adding new payloads and exploit paths as the campaign matured.