Loading story…
Researchers from CloudSEK Threat Intelligence (TRIAD) have uncovered a rapidly expanding Loader-as-a-Service (LaaS) campaign, known as the Morte botnet, which systematically compromises SOHO routers, IoT devices, enterprise applications, and CMS platforms. The campaign has been active for at least six months and has demonstrated a significant 230% increase in attack volume between July and August 2025. Attackers exploit web-based command injection vulnerabilities, particularly through unsanitized POST parameters such as ntp, syslog, and hostname fields, allowing them to execute arbitrary shell commands on targeted devices. The botnet also leverages default credentials, such as admin:admin, using brute force and credential spraying techniques to gain unauthorized access. Key targets include Oracle WebLogic servers, WordPress sites, vBulletin forums, and other Linux-based systems, with exploitation of known vulnerabilities like CVE-2019-16759 (vBulletin), CVE-2019-17574 (WordPress Popup Maker), and CVE-2012-1823 (PHP-CGI RCE). Once access is obtained, attackers deploy small shell scripts as droppers, which then deliver native binaries such as the Morte malware and cryptomining payloads. The infrastructure supporting the botnet is highly dynamic, rotating across dozens of IP addresses to evade detection and takedown efforts. The campaign has also been observed distributing Mirai-like bots, further expanding its reach and impact. Post-exploitation, the botnet uses commands like [ReplyDeviceInfo] for reconnaissance and [ConfigSystemCommand] for command injection, enabling persistent control over compromised devices. Security researchers gained insight into the operation by accessing exposed command-and-control (C2) logs, which detailed the attackers' methods and infrastructure. Organizations are advised to mitigate risk by blocking egress traffic, enforcing strong and unique credentials, updating device firmware, segmenting IoT and embedded devices, and replacing end-of-life hardware. Additional recommendations include adopting Sigma rules to detect suspicious POST parameter activity and collecting forensic artifacts for incident response. The campaign's use of multi-architecture malware and BusyBox tools allows it to target a wide range of devices, increasing its effectiveness and threat level. The loader-as-a-service model enables other threat actors to leverage the botnet's infrastructure for their own payloads, further complicating defense efforts. The rapid growth and sophistication of the Morte botnet highlight the ongoing risks posed by insecure web interfaces and outdated devices in both enterprise and home environments. The campaign's ability to exploit both known and zero-day vulnerabilities underscores the importance of timely patching and proactive security measures. CloudSEK's findings emphasize the need for continuous monitoring and threat intelligence sharing to counter evolving botnet threats. The exposure of C2 logs has provided valuable intelligence, but the botnet's operators continue to adapt their tactics to maintain operational resilience. The Morte botnet campaign represents a significant and ongoing threat to organizations relying on internet-exposed devices and applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2025-09-29, reporting described a novel loader-as-a-service operation dubbed the Morte botnet that was deploying Mirai bots. The campaign was said to target routers and enterprise applications and to be growing rapidly.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 28, 2026
The RondoDox botnet has emerged as a significant threat, actively targeting a wide array of internet-exposed infrastructure by exploiting over 50 known vulnerabilities, many of which were first disclosed during Pwn2Own hacking competitions. Security researchers from Trend Micro and FortiGuard Labs have observed the botnet leveraging an 'exploit shotgun' approach, simultaneously deploying numerous exploits to maximize infection rates across diverse device types. The campaign has been active globally since at least June 2025, with attacks focusing on routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and other network devices from more than 30 vendors. Notably, the botnet exploits both recent and older vulnerabilities, including CVE-2023-1389 in the TP-Link Archer AX21 Wi-Fi router, which was originally demonstrated at Pwn2Own Toronto 2022 and previously targeted by Mirai. The list of exploited vulnerabilities includes CVE-2024-3721, CVE-2024-12856, and many others affecting brands such as Digiever, QNAP, LB-LINK, TRENDnet, D-Link, TBK, Four-Faith, Netgear, AVTECH, TOTOLINK, Tenda, Meteobridge, Edimax, and Linksys. Many of these vulnerabilities are now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for organizations to patch affected systems. Devices that have reached end-of-life are particularly at risk, as they are less likely to receive security updates, making them attractive targets for the botnet operators. The campaign exposes organizations to risks including data exfiltration, persistent network compromise, and operational disruption, especially for those with internet-facing infrastructure. Security experts recommend prioritizing the patching of all listed vulnerabilities, conducting regular vulnerability assessments, segmenting networks to limit lateral movement, and continuously monitoring for anomalous device activity. Trend Micro has indicated that its solutions provide protection against the vulnerabilities exploited by RondoDox, offering mitigation while patching is underway. The rapid weaponization of vulnerabilities demonstrated at Pwn2Own highlights the need for organizations to monitor disclosures from such competitions and act swiftly to secure their environments. The RondoDox botnet’s ability to quickly expand its arsenal of exploits demonstrates a high level of adaptability and threat actor sophistication. The campaign’s global reach and the diversity of targeted devices suggest that organizations across multiple sectors are at risk. The use of mass n-day exploitation, rather than relying solely on zero-day vulnerabilities, allows the botnet to compromise a large number of devices that may not be promptly patched. Security researchers emphasize the importance of defense-in-depth strategies to mitigate the impact of such widespread exploitation campaigns. The ongoing activity of RondoDox serves as a stark reminder of the persistent threat posed by botnets leveraging known vulnerabilities in widely deployed network devices.
Jun 29, 2026