Loading story…
Researchers reported that the Mylobot botnet remains active on Windows systems and continues to evolve around two main malware components: mylobot-core and mylobot-proxy. The malware uses a shared packer-shellcode loader to unpack and inject later-stage payloads, with mylobot-core functioning largely as a downloader and mylobot-proxy converting infected devices into proxy nodes. Investigations found that proxy monetization appears to be the operation’s primary business model, with infected hosts feeding a broader residential-style proxy network.
Analysis also linked Mylobot infrastructure to the bhproxies proxy service, including overlap between bhproxies assets and newer Mylobot command-and-control domains. Researchers said mylobot-proxy had abandoned its earlier fake-DGA technique by 2022, while mylobot-core continued using encrypted fake-DGA domain infrastructure to retrieve follow-on payloads, especially the proxy module. Despite years of public exposure and relatively high detection rates, the botnet was assessed as still active and expanding, underscoring the persistence of criminal proxy-botnet operations.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
As of March 2023, Qianxin had captured a version of mylobot-proxy that used a unique software update mechanism. The malware also retained privileged instructions for downloading and executing additional payloads.
The Mylobot group updated the command-and-control infrastructure used by mylobot-proxy in late February 2023. Qianxin also noted overlap between newer Mylobot C2 infrastructure and bhproxies-linked assets.
An updated 2022 version of mylobot-proxy no longer used the earlier Fake-DGA approach for command-and-control. The report contrasts this with mylobot-core, which still used encrypted Fake-DGA domains.
Deep Instinct discovered the Windows-focused Mylobot botnet and gave it its name. The malware family was later observed operating multiple components including mylobot-proxy and mylobot-core.
Qianxin reported that the Mylobot group's Packer-Shellcode loader had not been significantly updated since 2017. The loader continued to unpack and inject later-stage payloads for the botnet.
BitSight previously linked Mylobot infrastructure to the bhproxies proxy service. Qianxin said its own analysis later reached the same conclusion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 84 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Silent Push reported that the long-running **SystemBC** (aka **Coroxy** / **DroxiDat**) malware family has expanded into a botnet of **more than 10,000 unique infected IPs** globally. SystemBC primarily functions as a **SOCKS5 proxy** and **backdoor**, enabling threat actors to relay command-and-control and other malicious traffic through victim systems to obscure attribution and maintain persistent access; some variants have also been linked to **ransomware-adjacent activity** dating back to 2019. The research indicates infections are concentrated in the **United States** (with additional hotspots including **Germany, France, Singapore, and India**) and includes compromises in **sensitive infrastructure**, such as IPs hosting government websites in **Burkina Faso** and **Vietnam**. Silent Push observed SystemBC infrastructure using **abuse-tolerant/bulletproof hosting** (including `bthoster[.]com` and **AS213790 / BTCloud**) and identified a **previously undocumented Perl-based variant**, suggesting ongoing development. Reporting also notes the botnet’s resilience following Europol’s **Operation Endgame** disruption efforts, with indications that operators have adapted their infrastructure and targeting to sustain long-lived infections.
Jun 29, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 28, 2026