TheMoon

TheMoon is malware targeting network edge and IoT devices, especially legacy Linksys and Cisco routers, and has also been associated with ASUS router targeting. It has been used to compromise vulnerable devices and enroll them into botnet and residential proxy infrastructure. In May 2025, U.S. and Dutch law enforcement dismantled the 5socks/Anyproxy criminal proxy services, which had turned years-old Linksys and Cisco routers infected with TheMoon into residential proxies sold commercially. The malware has historically exploited Linksys router vulnerabilities, including the /tmUnblock.cgi command-injection issue referenced as CVE-2025-34037, which the content states had been documented since 2013 and historically exploited by TheMoon. Multiple sources in the content cite prior real-world exploitation of Linksys flaws by TheMoon and note that unsupported consumer networking devices remain at risk. TheMoon is also referenced as part of the broader pattern of router-based proxy botnets alongside campaigns such as AVrecon and SocksEscort. Infrastructure and services linked to Faceless and its apparent successor Doppelganger were described as previously associated with TheMoon malware, indicating its use in proxy-for-rent ecosystems. High-confidence behavior directly stated in the content is that TheMoon compromises vulnerable IoT/network devices and converts them into proxy nodes; the content also states that recent updates have improved its effectiveness and evasion capabilities. Associated indicators and artifacts mentioned in the content include exploitation of Linksys /tmUnblock.cgi and use of infected devices in the 5socks and Anyproxy residential proxy networks.