Loading story…
Researchers reported that the Roboto botnet has been compromising internet-exposed Linux servers by exploiting the Webmin remote code execution flaw CVE-2019-15107, which allowed attackers to run code with root privileges on vulnerable older versions. Attacks began within days of the vulnerability’s disclosure, and investigators said the campaign initially focused on expanding the botnet rather than launching visible disruption, even though the malware includes distributed denial-of-service capabilities.
Analysis from 360 Netlab found Roboto uses a downloader-and-bot ELF pair, with the downloader fetching the payload while disguising it as Google font files such as roboto.ttc. The malware provides reverse shell access, command execution, host and network reconnaissance, file download and upload, encrypted payload execution, and self-uninstall features, while maintaining persistence through fake process names and Linux startup scripts. Researchers said Roboto’s peer-to-peer architecture and use of cryptographic protections including Curve25519, Ed25519, TEA, SHA256, and HMAC-SHA256 could complicate takedown efforts, and they identified hard-coded peer nodes in multiple countries along with a local control socket at /tmp/.cs.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
On October 11, 2019, 360Netlab's Anglerfish honeypot captured a second ELF sample that functioned as a downloader for the earlier Roboto bot. The downloader fetched the bot from hard-coded URLs, including one disguised as a Google font file named roboto.ttc.
On August 26, 2019, 360Netlab detected a suspicious ELF file later identified as a Roboto P2P bot program. This was one of the earliest observed samples tied to the botnet.
The Webmin team disclosed and patched a remote code execution vulnerability in August 2019. The flaw affected older Webmin versions and allowed attackers to execute code with root privileges.
Qihoo 360 Netlab published research identifying Roboto as a Linux P2P botnet exploiting vulnerable Webmin servers. The analysis described its botnet-expansion focus, peer-to-peer architecture, and built-in but not yet observed DDoS capabilities.
360Netlab observed host 51.38.200.230 spreading the Roboto downloader by exploiting Webmin RCE vulnerability CVE-2019-15107. The exploit downloaded a file from 190.114.240.194 to /tmp and executed it, and the spreading host itself appeared possibly compromised.
360Netlab said Roboto had continued targeting Webmin servers for the previous three months, primarily focusing on expanding the botnet. Researchers observed the malware growing in both size and code complexity over that period.
Within days of the Webmin vulnerability disclosure, attackers started targeting internet-exposed vulnerable Webmin installations. Roboto was identified as one of the early threats exploiting the flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026
Microsoft and CUJO AI reported that **Zerobot**, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak `SSH` and `Telnet` credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including `CVE-2021-42013` in Apache, `CVE-2022-33891` in Apache Spark, **Spring4Shell**, and **F5 BIG-IP** flaws. Researchers said the botnet delivered architecture-specific binaries or a `zero.sh` script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network. The newer **Zerobot 1.1** variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as **Mozi**, **Kaiten**, **Sora**, **Phantom**, **Nbrute**, and `minerd`. Investigators linked activity to infrastructure including the domain `zero.sudolite.ml` and IP addresses `176.65.137.5` and `176.65.137.6`, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Aug 15, 2026
ESET reported that **Linux/Rakos** is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default **SSH** credentials, then enrolling the systems into a botnet. The malware, written in **Go** and often packed with **UPX**, hides under names such as `.javaxxx`, `.swap`, and `kworker`, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module. The activity mirrors earlier Linux botnet campaigns such as **Linux/Moose**, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced **Telnet** on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Aug 14, 2026