Loading story…
The Momentum botnet was observed compromising Linux-based internet-facing devices and using them to launch distributed denial-of-service attacks, with infections spanning routers, DVRs, web servers, GPON equipment, and other exposed services. Trend Micro reported that the malware targeted multiple CPU architectures, established persistence by modifying rc files, connected to IRC command-and-control infrastructure including the #HellRoom channel, and in one analyzed case deployed a Mirai backdoor while also using Kaiten and Bashlite variants in its broader operations.
The activity was tied to exploitation of known router remote-code-execution weaknesses, including publicly disclosed flaws affecting ZyXEL, Billion, and TrueOnline devices, helping the operators expand a botnet that reportedly showed 1,232 victims on an observed C2 server. Once enrolled, infected systems could be directed to carry out 36 attack methods, including SYN, ACK, UDP, HTTP, LDAP, DNS, Memcache, and Valve Source Engine amplification floods, while also supporting proxying, shell-command execution, and fast-flux techniques to keep command infrastructure resilient.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that Momentum command-and-control infrastructure was still live as recently as November 18, 2019. The investigated C2 server reportedly showed 1,232 victims at the time of analysis.
A Full Disclosure post reported multiple remote code execution vulnerabilities affecting ZyXEL, Billion, and TrueOnline routers. The Trend Micro analysis later identified router exploits as part of Momentum botnet propagation activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026
A Mirai variant rapidly spread by targeting **ZyXEL PK5001Z** routers affected by `CVE-2016-10401`, a backdoor account flaw that exposed hardcoded Telnet credentials and a hidden path to root access. After proof-of-concept exploit code was published, attackers began scanning ports `23` and `2323` at scale, logging in with credentials including `admin/CenturyL1nk` and `admin/QwestM0dem`, then using the device's built-in super-user capability to install Mirai malware on vulnerable internet-exposed routers. Researchers reported nearly **100,000 unique scanning IPs** over roughly 60 hours, with a large share of activity traced to Argentina, particularly networks associated with Telefonica de Argentina. Netlab linked the campaign to command-and-control servers at `bigboatreps.pw:23` and `blacklister.nl:23`, and said the malware was distributed in multiple CPU-specific builds before both servers were later sinkholed by the security community. The vulnerable modem version cited in public exploit material was **PK5001Z 2.6.20.19**, a model used by CenturyLink.
Aug 15, 2026