Moobot/Mirai Botnet Resurgence: Open Directory Exposure of 'StresD Pro+' DDoS-as-a-Service Panel — OTX Pulse Analysis & Detection Pack

Threat Summary

A single but high-value OTX pulse submitted by AlienVault documents a significant operational security failure by an active cybercrime operation: a misconfigured open directory on 86.53.111[.]212:8080 that exposed the full internal workings of an ongoing Moobot botnet operation — including source code, DDoS attack tooling, attack records, and a fraudulent Chinese identity verification service.

Critically, this activity is observed after the 2024 court-authorized disruption of Moobot infrastructure (the FBI-led operation that neutralized the botnet's C2 layer). The pulse demonstrates what defenders consistently observe with Mirai-derived botnets: source code leakage ensures near-immortal persistence. Because Moobot's codebase derives from Mirai, any actor with the leaked code can stand up successor infrastructure — and that is precisely what this pulse captures.

The exposed directory contained:

• Moobot botnet source code — enabling further variant proliferation
• StresD Pro+ — a multi-user DDoS-for-hire panel with 16 registered accounts and 32 recorded attacks, indicating active commercial operation
• Denial-of-service tooling with attack records — evidence of DDoS-as-a-service transactions
• A fraudulent Chinese identity verification service — suggesting a diversified criminal operation spanning botnet monetization and identity fraud

The OTX metadata attributes this pulse to APT28, though defenders should treat this attribution with caution: Moobot/Mirai botnets and DDoS-for-hire panels are characteristically cybercrime ecosystem tooling, not nation-state tradecraft. The attribution may reflect overlap in targeting, infrastructure reuse, or a tagging artifact. The operational takeaway is unchanged: a Mirai-derived IoT botnet is active, monetized, and rebuilding post-takedown.

Objective: Commercial DDoS-as-a-service operations targeting Chinese entities, combined with identity verification fraud services — a diversified criminal revenue model built on compromised IoT infrastructure.

Threat Actor / Malware Profile

Moobot (Mirai-derived IoT Botnet)

Lineage: Moobot is a Mirai-variant botnet first widely documented in 2019, historically associated with exploitation of vulnerable routers, DVRs, and IoT devices. It gained renewed attention when it was deployed by Sandworm-linked actors against compromised routers, and was subsequently disrupted in a 2024 court-authorized operation.

Distribution method:

• Scanning for internet-exposed IoT devices with default or weak Telnet/SSH credentials (classic Mirai brute-force tables)
• Exploitation of known router/NVR vulnerabilities (e.g., Hikvision, D-Link, GPON router flaws — common Moobot vectors)
• Worm-like self-propagation from infected devices

Payload behavior:

• Infects Linux-based embedded devices (MIPS, ARM, x86 builds)
• Kills competing botnet processes and closes infection vectors (Telnet/SSH hardening post-compromise to lock out rivals)
• Awaits C2 commands for DDoS floods: TCP, UDP, HTTP, GRE, and application-layer attack vectors

C2 communication:

• Outbound connection to hardcoded C2 domains/IPs over custom TCP binary protocol (Mirai-style)
• The pulse indicator api.cemg.xyz is consistent with C2 or panel API infrastructure and should be treated as hostile
• DDoS panel infrastructure (StresD Pro+) communicates with botnet C2 to task registered customers' purchased attacks

Persistence mechanism:

• On IoT devices: typically memory-resident with watchdog scripts; reinfection via persistent scanning
• On Linux servers: cron entries, init scripts, systemd service units masquerading as legitimate services

Anti-analysis techniques:

• Process name masquerading (e.g., dropbear, [kworker])
• String obfuscation/XOR-encoded configuration (C2 addresses, credential tables)
• Anti-emulation checks and debugger detection in later Mirai variants
• The 2024 takedown's sinkholing means current samples likely use updated C2 lists — the api.cemg.xyz indicator is therefore high-value

StresD Pro+ (DDoS Panel)

A multi-user booter/stresser panel with 16 registered operator accounts and 32 logged attacks. Panels of this type provide attack purchasing, target input, and attack method selection over a web UI, fronting the underlying botnet. Its presence in the open directory confirms commercialization — this is a criminal service business, not opportunistic vandalism.

IOC Analysis

The pulse provides a limited but high-signal indicator set:

Operationalization guidance for SOC teams:

1. Domain blocking: Add api.cemg.xyz to DNS sinkholes, secure web gateways, and EDR network blocks. Mirai-derived C2 domains are frequently short-lived, so also enable passive DNS monitoring to identify resolving IPs for retro-hunting.
2. IP blocking: Block 86.53.111[.]212 at perimeter firewalls and egress proxies. The :8080 service hosted the exposed directory; any internal host communicating with it requires immediate triage.
3. Retroactive hunting: Query DNS logs, proxy logs, and NetFlow for 90+ days of history against both indicators. IoT botnet C2 beacons are low-and-slow — a single historical hit on an unmanaged device is a strong infection signal.
4. Tooling: Use Censys/Shodan to monitor for additional open directories or Moobot panels (the Censys research referenced in this pulse is the discovery source). Pivot on certificate transparency logs and passive DNS for sibling infrastructure registered alongside cemg.xyz.
5. IoT/OT visibility gap: Traditional EDR does not cover routers, cameras, and embedded devices — the primary Moobot targets. Compensate with network-layer detection: DNS analytics, egress connection monitoring, and NetFlow baselining for IoT VLANs.

Detection Engineering

---
title: Mirai/Moobot IoT Botnet Infection Behavior on Linux Hosts
description: Detects common Mirai/Moobot post-exploitation behavior on Linux systems including killing competing processes, disabling watchdogs, and downloading payloads via wget/curl to /tmp with execution.
id: a3f7c2e1-9b4d-4e8a-b1c5-3d2e6f8a9c01
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://censys.com/blog/open-directory-exposes-moobot-source-code-and-activity/
date: 2026/09/27
logsource:
    category: process_creation
    product: linux
detection:
    selection_download_tmp:
        Image|endswith:
            - '/wget'
            - '/curl'
            - '/tftp'
        CommandLine|contains:
            - '/tmp/'
            - '/var/run/'
            - '/dev/shm/'
    selection_chmod_exec:
        Image|endswith:
            - '/chmod'
        CommandLine|contains:
            - '+x'
            - '777'
    selection_kill_competitors:
        Image|endswith:
            - '/busybox'
            - '/pkill'
            - '/kill'
        CommandLine|contains:
            - 'mirai'
            - 'qbot'
            - 'mosquito'
            - 'watchdog'
    condition: selection_download_tmp or (selection_chmod_exec and selection_kill_competitors)
falsepositives:
    - Legitimate software deployment scripts downloading to /tmp
level: high
tags:
    - attack.t1105
    - attack.t1059.004
---
title: Network Connection to Moobot C2 Infrastructure - api.cemg.xyz
description: Detects DNS resolution or network connections to known Moobot botnet C2/panel infrastructure identified in OTX pulse.
id: b7e1d4f2-5c8a-4f9b-a2d6-8e3c1f7b5d02
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://censys.com/blog/open-directory-exposes-moobot-source-code-and-activity/
date: 2026/09/27
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'cemg.xyz'
    condition: selection
falsepositives:
    - Threat intelligence research activity
level: critical
tags:
    - attack.t1071.001
    - attack.t1102
---
title: Outbound Telnet/SSH Scanning from Internal Host - IoT Botnet Propagation
description: Detects mass outbound connection attempts on Telnet/SSH ports characteristic of Mirai/Moobot worm-like propagation from an infected internal device.
id: c9d2e5f3-7a1b-4c8d-b3e7-9f4a2c6d8e03
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/09/27
logsource:
    category: firewall
detection:
    selection:
        dst_port:
            - 23
            - 2323
            - 22
        src_ip|contains:
            - '10.'
            - '192.168.'
            - '172.16.'
    condition: selection
falsepositives:
    - Legitimate network administration and SSH management
    - Vulnerability scanners
level: medium
tags:
    - attack.t1021.004
    - attack.t1046

// Hunt for Moobot/Mirai C2 communication and IoT botnet propagation behavior
// Lookback: 30 days recommended for initial retro-hunt
let MoobotIOCs = dynamic(["api.cemg.xyz", "86.53.111.212"]);
let C2Hits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl in~ (MoobotIOCs) or RemoteIP in~ (MoobotIOCs)
| project Timestamp, DeviceName, LocalIP, RemoteIP, RemoteUrl, RemotePort,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend DetectionType = "C2_Indicator_Match";
let PropagationHits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemotePort in (23, 2323)
| summarize ConnectionCount = count(), DistinctTargets = dcount(RemoteIP),
    TargetList = make_set(RemoteIP, 50) by DeviceName, LocalIP,
    InitiatingProcessFileName, bin(Timestamp, 1h)
| where DistinctTargets > 20  // Mirai-style mass Telnet scanning threshold
| extend DetectionType = "IoT_Scanning_Behavior";
union C2Hits, PropagationHits
| sort by Timestamp desc

# Moobot/Mirai IOC Hunt Script - Windows & Infrastructure Systems
# Checks network connections, DNS cache, and persistence artifacts
# Run elevated. Output: CSV of findings for triage.

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()
$iocDomains = @('cemg.xyz')
$iocIPs = @('86.53.111.212')

Write-Host "[*] Moobot/Mirai IOC Hunt - $(Get-Date)" -ForegroundColor Cyan

# 1. Active and recent network connections to known Moobot infrastructure
Write-Host "[*] Checking network connections..."
$conns = Get-NetTCPConnection | Where-Object { $iocIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess
    $findings += [PSCustomObject]@{
        Type = 'NetworkConnection'; Indicator = $c.RemoteAddress
        Detail = "PID $($c.OwningProcess) - $($proc.ProcessName) - State: $($c.State)"
        Timestamp = Get-Date
    }
}

# 2. DNS client cache check for C2 domain
Write-Host "[*] Checking DNS cache..."
$dns = Get-DnsClientCache | Where-Object {
    foreach ($d in $iocDomains) { if ($_.Entry -like "*$d*") { $true } }
}
foreach ($entry in $dns) {
    $findings += [PSCustomObject]@{
        Type = 'DNSCache'; Indicator = $entry.Entry
        Detail = "Resolved to: $($entry.Data)"; Timestamp = Get-Date
    }
}

# 3. Persistence artifact check - scheduled tasks with suspicious payloads
Write-Host "[*] Checking scheduled tasks..."
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match '(/tmp/|/dev/shm|wget |curl |tftp |busybox)') {
        $findings += [PSCustomObject]@{
            Type = 'ScheduledTask'; Indicator = $_.TaskName
            Detail = $actions.Trim(); Timestamp = Get-Date
        }
    }
}

# 4. Firewall log check for Telnet/2323 egress (propagation indicator)
Write-Host "[*] Checking firewall logs for Telnet scanning..."
$fwLog = "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log"
if (Test-Path $fwLog) {
    $scanHits = Get-Content $fwLog -Tail 5000 | Where-Object {
        $_ -match '\s(23|2323)\s' -and $_ -match 'SEND'
    } | Select-Object -First 20
    foreach ($hit in $scanHits) {
        $findings += [PSCustomObject]@{
            Type = 'EgressScan'; Indicator = 'Telnet/2323 egress'
            Detail = $hit; Timestamp = Get-Date
        }
    }
}

if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\moobot_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) findings exported. ESCALATE FOR TRIAGE." -ForegroundColor Red
} else {
    Write-Host "[+] No Moobot/Mirai indicators found on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0-4 hours):

• Block api.cemg.xyz at DNS resolvers, secure web gateways, and EDR network controls; block 86.53.111[.]212 at perimeter firewalls and egress proxies
• Deploy the Sigma and KQL detections above to SIEM/Sentinel; initiate the 30-day retro-hunt for C2 contact
• Audit egress traffic from IoT/OT VLANs (cameras, routers, printers, building systems) for Telnet/2323 scanning and anomalous outbound connections
• Inventory any unmanaged or shadow IoT devices — these are the most likely Moobot hosts

24 Hours:

• If any internal device shows C2 contact or DDoS participation: isolate from network, capture volatile memory where possible, and reimage/replace (IoT devices often cannot be cleaned reliably)
• Rotate credentials on any network device (routers, switches, IoT) that used default or weak Telnet/SSH passwords — assume brute-forced
• Review whether any DDoS traffic originating from your egress IPs was flagged by upstream providers — botnet membership can degrade reputation and trigger ISP notification
• Check DDoS exposure: if your organization operates services targeting or relating to Chinese entities, assess whether you appear in StresD Pro+ target lists via threat intelligence channels

1 Week (Architecture Hardening):

• Segment IoT/OT devices into dedicated VLANs with deny-by-default egress policies — IoT devices rarely need arbitrary internet access
• Disable Telnet on all network devices; enforce SSH with key-based auth and unique credentials; replace default passwords fleet-wide
• Patch or replace end-of-life routers, NVRs, and embedded devices with known Mirai/Moobot exploitation paths (Hikvision, D-Link, GPON)
• Implement DNS-layer filtering with threat intel feeds to catch future C2 rotations — Moobot infrastructure will cycle domains
• Subscribe to Censys/Shodan monitoring for your IP space to detect exposed services before botnet scanners do
• Brief leadership: the 2024 Moobot takedown did not eliminate the threat — leaked Mirai-derived source guarantees continued variant proliferation

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub