Loading story…
Researchers reported that newer variants of Linux/Moose continue to infect Linux-based consumer routers and other embedded Linux devices, where the malware steals unencrypted network traffic, harvests HTTP cookies, and abuses compromised systems as proxies to generate fraudulent social-media activity such as fake follows, views, and likes. The malware remains memory-resident, so a reboot stops execution, but it still propagates through Telnet credential brute-forcing against exposed devices.
The updated variants changed several operational details to hinder detection and analysis. Instead of embedding the command-and-control IP address directly in the binary, operators now pass it as an encrypted command-line argument, and the malware’s communications shifted from a binary protocol to an ASCII-printable format carried in HTTP headers. Researchers also observed a proxy listener change from TCP port 10073 to TCP port 20012, along with reduced password and whitelist lists compared with earlier versions, and published indicators of compromise including sample hashes, primary C2 infrastructure, and whitelist IP addresses.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
ESET released an updated analysis of Linux/Moose, including sample hashes, primary command-and-control IP addresses, and whitelist IP addresses for multiple versions.
The newer Linux/Moose proxy service changed its listening port from TCP 10073 used by previous variants to TCP 20012 while remaining memory-resident.
Compared with 2015 versions, the newer Linux/Moose samples cut their Telnet brute-force password list from around 300 pairs to about 10 and reduced the whitelist from about 50 IPs to about 10.
Newer Linux/Moose variants removed the command-and-control IP from the binary, passed it as an encrypted command-line argument, and shifted communications from a binary protocol to an ASCII-printable format embedded in HTTP headers.
A new Linux/Moose malware sample was obtained, indicating the malware family remained active after the earlier infrastructure disruption.
ESET published a whitepaper on the Linux/Moose malware family, documenting its targeting of Linux-based consumer routers and its use in traffic theft and social-media fraud.
After ESET published its 2015 whitepaper, the command-and-control servers associated with Linux/Moose went offline.
ESET and GoSecure collaborated for about a year to further investigate Linux/Moose, including its social-media fraud ecosystem that GoSecure called the "Ego Market."
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how the **Linux/Moose** botnet compromised Linux-based routers and embedded IoT devices, then used those systems as proxy nodes to run large-scale social media fraud. The malware primarily abused weak or default credentials rather than a software exploit, infected devices from vendors including **Actiontec, Hik Vision, Netgear, Synology, TP-Link, ZyXEL, and Zhone**, and automated actions such as creating fake accounts, following users, liking posts, and viewing videos while staggering activity to mimic human behavior. Analysis indicated Instagram was a major target, and the malware also removed competing malware from infected routers and scanned for additional devices to compromise. A broader investigation linked Linux/Moose to the commercial supply chain behind fake likes and followers, highlighting bulk reseller panels and software panel sellers as key enablers of the fraud ecosystem. Researchers found a whitelist of seven IP addresses in the malware that likely supported centralized fake-account management, suggesting coordination by the same actor rather than unrelated resellers. The reports said customer-facing sellers likely captured the highest margins, while upstream panel operators depended on bulk volume, and warned that infected routers could also be repurposed for **DDoS**, network reconnaissance, eavesdropping, and **DNS hijacking** beyond social-media manipulation.
Aug 15, 2026
ESET reported that **Linux/Rakos** is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default **SSH** credentials, then enrolling the systems into a botnet. The malware, written in **Go** and often packed with **UPX**, hides under names such as `.javaxxx`, `.swap`, and `kworker`, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module. The activity mirrors earlier Linux botnet campaigns such as **Linux/Moose**, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced **Telnet** on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Aug 14, 2026
Security researchers detailed multiple Linux malware families that rely on native persistence mechanisms and outbound command-and-control to maintain access on compromised hosts. Intezer analyzed a stripped, statically linked ELF sample it classified as **Reekoobe** through code reuse, finding strings tied to a service named `likemae` and the domain `c[.]linux-hosts[.]com`. In dynamic analysis, the malware renamed itself to `/usr/bin/likemae`, created and enabled `likemae.service` for persistence when run with elevated privileges, and repeatedly attempted DNS lookups and TCP connections to its C2 infrastructure, although the observed port returned `RST,ACK` responses and blocked further interaction. Anomali separately documented the **Linux Rabbit** and **Rabbot** malware strains in a cryptomining campaign that installed Monero miners on Linux servers and IoT devices. Linux Rabbit used Tor hidden services and gateways for C2, persisted through `rc.local` and `.bashrc`, brute-forced SSH credentials, removed competing miners, and deployed architecture-specific miners while also injecting CoinHive scripts into compromised websites; the related Rabbot variant expanded the operation with worm-like propagation, exploitation of known vulnerabilities, and payload delivery over port 80. Together, the reports show Linux threats combining persistence, remote access, propagation, and monetization techniques across servers, web hosts, and embedded devices.
Aug 15, 2026