MalwareUsed by 1 actorExploits 1 CVE

SenNight

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-24061GNU Inetutils telnetd remote authentication bypass via USER argument injection

The SenNight botnet (森狞僵尸网络 -- "Forest Fierce Zombie Network") ran a Flask-based attack panel on port 5000.

via breakglass intelintel.breakglass.tech

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

angelalk21

The SenNight botnet (森狞僵尸网络 -- "Forest Fierce Zombie Network") ran a Flask-based attack panel on port 5000.

via breakglass intelintel.breakglass.tech

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

TacticInitial Access

MITRE ATT&CK Mapping ... Initial Access T1190 Exploit Public-Facing Application CVE-2026-24061 telnetd bypass, Teltonika 0-day CGI injection, LBLink router exploit

Execution

2 techniques

T1053.003CronEvidence1

TacticsExecution Persistence Privilege Escalation

MITRE ATT&CK Mapping ... Persistence T1053.003 Crontab Crontab manipulation on compromised devices

T1059.004Unix ShellEvidence1

TacticExecution

MITRE ATT&CK Mapping ... Execution T1059.004 Unix Shell Shell commands via telnet/CGI injection, raw syscall dropper

Persistence

1 technique

T1053.003CronEvidence1

TacticsExecution Persistence Privilege Escalation

MITRE ATT&CK Mapping ... Persistence T1053.003 Crontab Crontab manipulation on compromised devices

Privilege Escalation

1 technique

T1053.003CronEvidence1

TacticsExecution Persistence Privilege Escalation

MITRE ATT&CK Mapping ... Persistence T1053.003 Crontab Crontab manipulation on compromised devices

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

TacticStealth

MITRE ATT&CK Mapping ... Defense Evasion T1027 Obfuscated Files DNS byte-swap, modified RC4, dead code injection, dummy KSA passes

T1070.004File DeletionEvidence1

TacticStealth

MITRE ATT&CK Mapping ... Defense Evasion T1070.004 File Deletion History clearing, competitor malware removal, unlink(argv[0])

Collection

1 technique

T1005Data from Local SystemEvidence1

TacticCollection

MITRE ATT&CK Mapping ... Collection T1005 Data from Local System Device compromise for botnet enrollment

Command and Control

2 techniques

T1095Non-Application Layer ProtocolEvidence1

TacticCommand and Control

MITRE ATT&CK Mapping ... Command and Control T1095 Non-Application Layer Protocol Custom CNC protocol (ports 1337/23004)

T1568.002Domain Generation AlgorithmsEvidence1

TacticCommand and Control

MITRE ATT&CK Mapping ... Command and Control T1568.002 Domain Generation / Resolution DNS byte-swap to obfuscate real C2 IP

Impact

1 technique

T1498.001Direct Network FloodEvidence1

TacticImpact

MITRE ATT&CK Mapping ... Impact T1498.001 Direct Network Flood UDP, SYN, ACK, PSH-ACK, ICMP floods

INDICATORS OF COMPROMISE

IOCs tracked for this family

40 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

30 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

10 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 5, 2026

SenNight Unmasked: Full Server Compromise of a Mirai-Fork Botnet Reveals DNS Byte-Swap Anti-Analysis, Operator Succession Chain, and 30Gbps DDoS Infrastructure - Breakglass Intelligence - Breakglass Intelligence

A Mirai-fork botnet used for DDoS operations. It uses a Flask-based panel, custom DNS byte-swap anti-analysis to hide real C2 infrastructure, RC4-like encrypted bot communications, self-deleting binaries, process killing, and supports multiple flood methods across 13 architectures.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching40

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.