Loading story…
Researchers reported that the Hide ‘N Seek malware evolved into a multi-stage IoT botnet that compromises internet-exposed devices through known exploits and brute-forced default credentials, then links them through a custom peer-to-peer UDP network instead of relying on centralized command-and-control. Analysis tied parts of its scanner module to Mirai code reuse, while the botnet’s protocol supported peer discovery, file distribution, and exfiltration from infected systems. Early tracking showed a network of roughly 1,000 peers with rapid daily growth, and later variants added stronger persistence and broader targeting across routers, Android devices exposed through ADB, and misconfigured services including MongoDB and CouchDB.
Subsequent samples showed the botnet continuing active development and widening its exploitation arsenal. Researchers said a 2019 variant added remote code execution attacks for ThinkPHP via CVE-2018-20062 and Sonatype Nexus Repository Manager via CVE-2019-7238, with evidence that Hide ‘N Seek exploited the Nexus flaw in the wild before other botnets publicly did. The malware also retained earlier capabilities such as hard-coded P2P peers, XOR-obfuscated strings, multi-architecture Linux binaries, and delivery of a Monero miner, although observed mining revenue appeared limited and the operators’ broader objectives remained unclear.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
A new Hide 'N Seek variant was first seen on 2019-02-21. It added exploitation for ThinkPHP CVE-2018-20062 and Nexus Repository Manager CVE-2019-7238 while retaining earlier exploit and peer-to-peer capabilities.
Unit 42 reported that Hide 'N Seek exploited CVE-2019-7238 in February 2019. The activity predated previously noted public exploitation of the same flaw by the DDG botnet in May 2019.
As of 2018-10-31, researchers observed that the botnet's Monero-mining operation had earned almost 0.9 XMR, worth roughly $90 at the time. The miner was based on coinminer-opt and used the moriaxmr.com pool.
In May 2018, researchers said Hide 'N Seek became the first known IoT malware capable of surviving device reboots. This marked a notable persistence milestone in the botnet's evolution beyond earlier IoT-focused infections.
In April 2018, Fortinet researcher J. Manuel reported signs that Hide 'N Seek reused code from the leaked Mirai source, particularly in its scanner module. This linked the botnet's propagation logic to earlier Mirai-derived malware.
By 2018, newer Hide 'N Seek samples had added persistence by copying themselves into init directories and expanded exploit coverage beyond TP-Link and Netgear to targets including Cisco, Belkin, AVTECH, HomeMatic, MongoDB, and CouchDB. This showed the botnet was evolving its post-infection durability and infection surface.
Bitdefender reported the Hide 'N Seek IoT botnet in late January 2018, marking its initial discovery in the wild. The botnet was notable for using a custom peer-to-peer communication model and infecting internet-exposed IoT devices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
labs.bitdefender.com
Open sourcelabs.bitdefender.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.avast.com
Open sourceblog.netlab.360.com
Open sourcebleepingcomputer.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Researchers tracked the Mirai-derived **Echobot** botnet as it rapidly expanded from 18 exploits to 59 and then **71** exploits, broadening propagation across routers, cameras, NAS devices, smart home hubs, servers, SD-WAN appliances, Oracle WebLogic, Barracuda Web Application Firewall, Citrix NetScaler, video conferencing systems, and administration tools. The malware relied heavily on publicly available remote code execution and command-execution exploits, including both legacy flaws dating back to 2003 and newer issues such as **`CVE-2019-15107`** in Webmin, showing how quickly commodity botnet code can be upgraded into large-scale exploit-driven malware. The most notable escalation was Echobot’s move into industrial environments through exploitation of **`CVE-2019-14927`** affecting Mitsubishi Electric remote terminal units, an uncommon step for a Mirai-family botnet toward **SCADA** and critical infrastructure-related devices. Researchers said the malware spread through a bash dropper named **Richard**, which downloaded, compiled, and executed payloads for at least 13 processor architectures, while infrastructure linked to the campaign included open or compromised servers and changing command-and-control domains and ports. The activity underscored Mirai’s continued evolution away from simple default-credential abuse and toward aggressive exploit-based propagation to build larger botnets, likely for **DDoS** operations.
Aug 15, 2026
Researchers and later federal prosecutors tied the Mirai-derived **Satori/Masuta** botnet activity to the alias **Nexus Zeta**, identified in court reporting as Kenneth Currin Schuchman. Security reporting said Satori rapidly infected hundreds of thousands of IoT devices by exploiting router flaws rather than relying only on default credentials, including `CVE-2017-17215` in Huawei gateways, `CVE-2014-8361` in Realtek UPNP SOAP interfaces, and a D-Link HNAP injection issue used by the **PureMasuta** branch. NewSky linked **Masuta** and **PureMasuta** to the same operator through shared command-and-control infrastructure and leaked source code, while investigators said operational security mistakes connected the botnet’s online persona to a real-world suspect. The malware family continued to evolve after initial disruption efforts. A successor dubbed **Satori.Coin.Robber** targeted exposed Claymore Miner management interfaces on port `3333` to redirect Ethereum mining rewards by changing pool and wallet settings, while still scanning for vulnerable devices on ports `37215` and `52869`. Later technical analysis showed Satori broadened support for additional processor architectures, including **superh** and **ARC**, making it one of the first known ARC-targeting malware families and underscoring how Mirai-style botnets were shifting toward exploit-driven propagation, persistent command-and-control, and large-scale DDoS capability across insecure embedded devices.
Aug 15, 2026