Loading story…
Researchers reported that a new InterPlanetary Storm malware variant broadened its reach from earlier Windows and Linux infections to Mac, Android, and a growing set of IoT devices, including Android-based TVs and Linux-based routers. Barracuda estimated the botnet had infected roughly 13,500 systems across 84 countries, with the highest concentration in Asia, while separate reporting highlighted the malware’s use of the InterPlanetary File System (IPFS) and a peer-to-peer architecture to operate in the wild.
The Go-based malware spreads through SSH dictionary attacks and exposed Android Debug Bridge (ADB) services, then establishes persistence, updates itself, detects honeypots, kills competing processes, and enables reverse shell access for operators. Researchers warned that the botnet’s backdoor access could be repurposed for DDoS, cryptomining, or other follow-on attacks, underscoring the risk of internet-exposed administrative services and poorly secured embedded devices.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A Linux-targeting InterPlanetary Storm variant was reported in June of the same year as the earlier Windows discovery. This showed the malware expanding beyond its initial Windows focus.
The first known InterPlanetary Storm malware variant targeting Windows was uncovered by Anomali. This marks the earliest explicitly dated discovery referenced in the source material.
Barracuda reported that the new variant spread through SSH dictionary attacks and exposed ADB services, used IPFS and libp2p for peer-to-peer communications, and provided backdoor access to infected devices. Researchers estimated the botnet had about 13,500 infected machines across 84 countries and published technical indicators including IPFS DHT keys, protocol IDs, and file hashes.
Barracuda researchers first detected a new InterPlanetary Storm variant in late August. The variant expanded targeting to Mac, Android, Windows, and Linux devices, with emphasis on IoT systems such as Android TVs and Linux routers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **P2PInfect** worm, a Rust-based cross-platform malware family, expanded beyond earlier `x86-64` infections to target **ARM** and **MIPS** systems, increasing the threat to IoT and embedded Linux environments. The worm spreads through multiple paths, including exploitation of **Redis** weaknesses and **SSH** brute-force activity, and uses a **peer-to-peer** architecture rather than a centralized command-and-control server, making disruption more difficult. Analysis of newer samples showed the malware also incorporates self-protection and evasion features, including anti-debugging checks, disabled core dumps, runtime modification of a dropped auxiliary binary, and wrapper ELF files used to conceal the main payload. Telemetry tied the campaign to growing infection activity from late 2023 into early 2024, with observed malicious connections frequently originating from **China, Hong Kong, and Singapore**, while published research also included detection content such as **YARA rules**, infrastructure indicators, and malware hashes to support defender response.
Aug 15, 2026
The Hajime malware infected nearly **300,000** internet-connected devices by combining multiple compromise methods against routers, cameras, DVRs, and cable modems. Researchers reported that the worm spread through **Telnet default-password attacks**, added a **TR-069** exploitation module for remote code execution, and abused an **Arris cable modem password-of-the-day** mechanism, allowing it to compromise vulnerable IoT systems at scale. The botnet used a peer-to-peer architecture and tailored downloader binaries to victim device architectures and WAN interfaces, while also refining banner-based brute-forcing and architecture detection to improve infection success. Victimology data showed broad global exposure, with the highest concentrations of infected hosts observed in **Iran, Brazil, Vietnam, Russia, and Turkey**. DHT leecher analysis identified **297,499 unique infected hosts**, and honeypot telemetry indicated many victims were consumer and small-office embedded devices. Despite the botnet’s size and continued evolution, researchers said they had not observed Hajime being used for overt attacks at the time of reporting, leaving its ultimate purpose unclear even as it was tracked as **`Backdoor.Linux.Hajime`**.
Jun 29, 2026
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026