Loading story…
Researchers documented a rapidly evolving Go-based botnet, reported as Zerobot and WSzero, that compromised vulnerable devices for distributed denial-of-service (DDoS) attacks. First observed on November 18, 2022, it progressed through four major versions by November 29, adding self-replication, string obfuscation, and propagation through 21 vulnerability or backdoor vectors plus SSH/Telnet weak-password attacks. A subsequent December variant expanded exploitation of cameras, network devices, and server applications. The malware supports Linux and Windows, although FortiGuard reported that it could not propagate to Windows machines.
The botnet supports HTTP_BYPASS, TCP, UDP, and ICMP attacks, arbitrary operating-system commands, scanning, and remote updates. Researchers observed JSON-based command-and-control traffic over TCP, WebSocket, and TLS-protected WebSocket, with some variants encoding server addresses using byte subtraction. Netlab first received a DDoS command on November 23; attack commands were relatively infrequent, but control infrastructure actively issued updates at the time. Defenders should prioritize patching exposed devices and applications, eliminating weak SSH/Telnet credentials, and monitoring for botnet traffic; FortiGuard reported antivirus, intrusion-prevention, and web-filtering coverage. These historical reports do not establish ongoing activity in 2026.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Fortinet first publicly reported Zerobot in a technical blog detailing its propagation, WebSocket command-and-control, DDoS capabilities, and arbitrary operating-system command execution. The report supplied malware hashes and infrastructure indicators and recommended patching vulnerable systems.
BotMon researchers first captured Wszero v4, which retained 21 exploit vectors, SSH/Telnet password cracking, and Linux and Windows support. The variant used WebSocket command-and-control at 176.65.137.5:80.
Researchers first captured Wszero v3.x, adding 21 exploit vectors, SSH/Telnet password cracking, and support for both Linux and Windows. FortiGuard's analysis likewise documented an updated Zerobot with self-replication and expanded propagation capabilities.
Researchers first captured Wszero v3, which used zero.sudolite.ml for command-and-control over TLS-protected WebSocket. Its stored C2 information was decoded by subtracting one from each byte.
BotMon researchers received their first Wszero DDoS command. Their analysis documented an HTTP_BYPASS attack instruction and additional TCP, UDP, and ICMP attack capabilities.
BotMon researchers first captured Wszero v2, which used WebSocket communications with 176.65.137.5:80 instead of the initial version's TCP channel. The variant continued to target Linux.
FortiGuard Labs dated Zerobot's first appearance to November 18, when BotMon researchers also first captured the family they named Wszero. The initial Go-based DDoS botnet targeted Linux and communicated with 176.65.137.5:1401 over TCP.
FortiGuard Labs reported a new variant adding propagation exploits affecting Zivif cameras, Grandstream devices, Sophos SG UTM, Apache HTTP Server, Roxy-WI, Apache Spark, and MiniDVBLinux. The report stated that Zerobot could run on Linux and Windows but could not propagate to Windows machines.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 85 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
fortiguard.fortinet.com
Open sourceblog.netlab.360.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and CUJO AI reported that **Zerobot**, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak `SSH` and `Telnet` credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including `CVE-2021-42013` in Apache, `CVE-2022-33891` in Apache Spark, **Spring4Shell**, and **F5 BIG-IP** flaws. Researchers said the botnet delivered architecture-specific binaries or a `zero.sh` script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network. The newer **Zerobot 1.1** variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as **Mozi**, **Kaiten**, **Sora**, **Phantom**, **Nbrute**, and `minerd`. Investigators linked activity to infrastructure including the domain `zero.sudolite.ml` and IP addresses `176.65.137.5` and `176.65.137.6`, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Aug 15, 2026
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026
The **Mozi** botnet infected routers, gateways, DVRs, NVRs, and other IoT devices through weak Telnet credentials and known vulnerabilities, then used a **DHT-based peer-to-peer** architecture to spread malware and maintain command-and-control without relying on centralized servers. Researchers said Mozi reused some Gafgyt code but stood apart for its decentralized design, XOR obfuscation, and **`ECDSA384`** signature checks that protected botnet configuration integrity. Infected devices could be directed to launch **DDoS** attacks, download and execute payloads, collect system information, and run arbitrary commands, while compromised nodes also hosted malware for further propagation over HTTP on random ports. Later analysis showed Mozi evolving beyond basic botnet activity by adding persistence mechanisms on **Netgear, Huawei, and ZTE** gateways, including startup-script changes, credential modification, service disabling, and port blocking. Microsoft reported the malware could also support **man-in-the-middle** activity such as DNS spoofing and HTTP session hijacking, raising the risk that compromised edge devices could become entry points into enterprise IT and OT networks. Netlab and other researchers found that even after action against its operators and a slowdown in updates, Mozi’s decentralized network continued to sustain lingering infections, while newer variants added Mirai-style C2 logic for DDoS coordination, UPnP port mapping, and additional node roles tied to mining activity.
Aug 15, 2026