Loading story…
Researchers detailed how the Linux/Moose botnet compromised Linux-based routers and embedded IoT devices, then used those systems as proxy nodes to run large-scale social media fraud. The malware primarily abused weak or default credentials rather than a software exploit, infected devices from vendors including Actiontec, Hik Vision, Netgear, Synology, TP-Link, ZyXEL, and Zhone, and automated actions such as creating fake accounts, following users, liking posts, and viewing videos while staggering activity to mimic human behavior. Analysis indicated Instagram was a major target, and the malware also removed competing malware from infected routers and scanned for additional devices to compromise.
A broader investigation linked Linux/Moose to the commercial supply chain behind fake likes and followers, highlighting bulk reseller panels and software panel sellers as key enablers of the fraud ecosystem. Researchers found a whitelist of seven IP addresses in the malware that likely supported centralized fake-account management, suggesting coordination by the same actor rather than unrelated resellers. The reports said customer-facing sellers likely captured the highest margins, while upstream panel operators depended on bulk volume, and warned that infected routers could also be repurposed for DDoS, network reconnaissance, eavesdropping, and DNS hijacking beyond social-media manipulation.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
On 17 July 2018, a RiskIQ PassiveTotal query found 977 domains hosted on an OVH IP address associated with a large cluster of social media fraud reseller panels. Many of the domains appeared to be SMF reseller panels, reinforcing the scale of the supporting infrastructure.
At VB2018 in 2018, Masarah Paquet-Clouston and Olivier Bilodeau presented research linking Linux/Moose botnet activity to the wholesale social media fraud ecosystem. Their analysis found the botnet primarily targeted Instagram and suggested the seven whitelisted IPs were likely controlled by the same actor rather than separate resellers.
Around the end of April 2016, researchers observed activity moving from one set of Linux/Moose whitelisted IP addresses to another. Overlap in the Instagram accounts followed across the old and new IP groups suggested an infrastructure change by the same operator rather than different resellers.
On May 26, 2015, ESET published a technical analysis of Linux/Moose, a worm affecting Linux-based routers and other devices. The report said the malware spread via weak Telnet credentials rather than a software vulnerability and was used for social media fraud such as creating bogus accounts and automating follows, likes, and views.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that newer variants of **Linux/Moose** continue to infect Linux-based consumer routers and other embedded Linux devices, where the malware steals unencrypted network traffic, harvests HTTP cookies, and abuses compromised systems as proxies to generate fraudulent social-media activity such as fake follows, views, and likes. The malware remains memory-resident, so a reboot stops execution, but it still propagates through Telnet credential brute-forcing against exposed devices. The updated variants changed several operational details to hinder detection and analysis. Instead of embedding the command-and-control IP address directly in the binary, operators now pass it as an encrypted command-line argument, and the malware’s communications shifted from a binary protocol to an ASCII-printable format carried in HTTP headers. Researchers also observed a proxy listener change from TCP port `10073` to TCP port `20012`, along with reduced password and whitelist lists compared with earlier versions, and published indicators of compromise including sample hashes, primary C2 infrastructure, and whitelist IP addresses.
Aug 14, 2026
ESET reported that **Linux/Rakos** is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default **SSH** credentials, then enrolling the systems into a botnet. The malware, written in **Go** and often packed with **UPX**, hides under names such as `.javaxxx`, `.swap`, and `kworker`, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module. The activity mirrors earlier Linux botnet campaigns such as **Linux/Moose**, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced **Telnet** on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Aug 14, 2026
The **Momentum botnet** was observed compromising Linux-based internet-facing devices and using them to launch distributed denial-of-service attacks, with infections spanning routers, DVRs, web servers, GPON equipment, and other exposed services. Trend Micro reported that the malware targeted multiple CPU architectures, established persistence by modifying `rc` files, connected to IRC command-and-control infrastructure including the `#HellRoom` channel, and in one analyzed case deployed a **Mirai** backdoor while also using **Kaiten** and **Bashlite** variants in its broader operations. The activity was tied to exploitation of known router remote-code-execution weaknesses, including publicly disclosed flaws affecting **ZyXEL**, **Billion**, and **TrueOnline** devices, helping the operators expand a botnet that reportedly showed **1,232 victims** on an observed C2 server. Once enrolled, infected systems could be directed to carry out **36** attack methods, including `SYN`, `ACK`, `UDP`, `HTTP`, `LDAP`, `DNS`, `Memcache`, and Valve Source Engine amplification floods, while also supporting proxying, shell-command execution, and fast-flux techniques to keep command infrastructure resilient.
Aug 14, 2026