Loading story…
The Hoaxcalls malware family has been observed building a DDoS botnet by exploiting remote code execution flaws in internet-exposed DrayTek and Grandstream UCM devices. Palo Alto Networks Unit 42 reported that the malware targets CVE-2020-8515 in DrayTek equipment and CVE-2020-5722 in Grandstream UCM systems, allowing infected devices to be enrolled into a botnet that supports multiple flood techniques, including UDP, HEX, and DNS attacks.
Researchers identified several Hoaxcalls variants with broadly similar capabilities but different propagation behavior: some begin exploiting vulnerable systems immediately after execution, while others wait for operator commands. The malware communicates with command-and-control servers over IRC, including infrastructure at 178[.]32[.]148[.]5:1337, and joins the #hellroom channel using randomized nick, ident, and user strings prefixed with XTC|. The activity shows active weaponization of widely exposed edge-device vulnerabilities, increasing the urgency for organizations to patch affected systems and review exposed voice and networking appliances.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Unit 42 documented three Hoaxcalls variant groups, including differences in whether exploitation was triggered by command or began automatically on execution. The report also disclosed command-and-control and hosting infrastructure, including 178[.]32[.]148[.]5:1337, 18[.]185[.]109[.]135:1337, and irc[.]hoaxcalls[.]pw.
Unit 42 reported that the Hoaxcalls DDoS botnet was actively propagating by exploiting CVE-2020-8515 in DrayTek devices and CVE-2020-5722 in Grandstream UCM devices. The malware used IRC-based command-and-control and supported multiple flood attack types.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 103 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026
Researchers reported a new **Gafgyt** botnet variant, **C0XMO**, exploiting `CVE-2021-27137`, a stack buffer overflow in the UPnP service of vulnerable **DD-WRT** firmware, to compromise internet-exposed devices. The malware was observed in March targeting a Japanese technology company, with exploitation triggered through malicious SSDP `M-SEARCH` requests to UDP port `1900`. After compromise, C0XMO drops files into `/tmp/.cache`, establishes persistence through hidden copies, cron jobs, shell profile changes, and self-reexecution, and removes competing malware and rival persistence mechanisms. C0XMO expands on earlier Gafgyt activity with a modular design that separates scanning and lateral movement into a standalone Python script, improving propagation across mixed Linux environments and CPU architectures. Researchers said the malware supports multiple Linux builds, connects to a command-and-control server at `85[.]215[.]131[.]70` using a custom handshake, and can execute heartbeat, scanning, and **19 DDoS attack methods**. Its scanner, retrieved from `217[.]160[.]125[.]125:15527`, performs random internet scanning, brute-forces **Telnet** and **SSH**, exploits multiple HTTP flaws, and abuses exposed **ADB** services to deploy architecture-specific payloads, indicating broad cross-platform botnet expansion.
Jul 22, 2026
The **Momentum botnet** was observed compromising Linux-based internet-facing devices and using them to launch distributed denial-of-service attacks, with infections spanning routers, DVRs, web servers, GPON equipment, and other exposed services. Trend Micro reported that the malware targeted multiple CPU architectures, established persistence by modifying `rc` files, connected to IRC command-and-control infrastructure including the `#HellRoom` channel, and in one analyzed case deployed a **Mirai** backdoor while also using **Kaiten** and **Bashlite** variants in its broader operations. The activity was tied to exploitation of known router remote-code-execution weaknesses, including publicly disclosed flaws affecting **ZyXEL**, **Billion**, and **TrueOnline** devices, helping the operators expand a botnet that reportedly showed **1,232 victims** on an observed C2 server. Once enrolled, infected systems could be directed to carry out **36** attack methods, including `SYN`, `ACK`, `UDP`, `HTTP`, `LDAP`, `DNS`, `Memcache`, and Valve Source Engine amplification floods, while also supporting proxying, shell-command execution, and fast-flux techniques to keep command infrastructure resilient.
Aug 14, 2026