Malware

Apex2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

...followed by credential brute-force attempts and the execution of the following commands...

Persistence

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Stealth

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Credential Access

1 technique

T1110Brute ForceEvidence1

The infection chain began with multiple Telnet connections to our honeypots, followed by credential brute-force attempts...

Discovery

1 technique

T1082System Information DiscoveryEvidence1

...sending the host’s OS and architecture... On connection, it authenticates with the hardcoded string “ChangeMe123!” and identifies the infected system’s hostname and user.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

The infection chain began with multiple Telnet connections to our honeypots...

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

After execution, the sample initiates communication with the C2 to register itself, sending the host’s OS and architecture using a simple plain-text protocol... Once running, the sample connects to a hardcoded C2 server and exchanges JSON messages over plaintext TCP...

T1105Ingress Tool TransferEvidence1

...followed by credential brute-force attempts and the execution of the following commands... During propagation, the attacker used “meow” as the filename for samples downloaded onto vulnerable systems.

Impact

2 techniques

T1498Network Denial of ServiceEvidence1

The bot receives commands from the C2 server instructing it to start or stop specific flood attacks... The supported attack types include: icmp, dnsudp, udp, http, directhttp, fasthttp, betterhttp, tcp, tcphandshake, dnstcp.

T1499Endpoint Denial of ServiceEvidence1

cf : HTTP(S) flood targeting Cloudflare-protected sites... tls , tlsplus and tlsplusbypass: TLS flood attacks... http: Performs HTTP GET or POST requests against a specified URL...

INDICATORS OF COMPROMISE

IOCs tracked for this family

18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

12 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

nozomi networks blogNews

Jul 6, 2026

Spring Botnet Floods: Golang Malware Targets Exposed IoT Systems

A Golang-based Mirai-derived botnet/evolution of Apex that targets Windows and Linux systems, registers with a C2 server, and executes multiple flood-based DDoS attacks including HTTP(S), UDP, TLS, Discord, and game-server targeting floods.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching18

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Apex2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

...followed by credential brute-force attempts and the execution of the following commands...

Persistence

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Stealth

1 technique

T1078Valid AccountsEvidence1

...a separate Golang-based SSH scanner being used to identify internet-exposed hosts with weak credentials.

Credential Access

1 technique

T1110Brute ForceEvidence1

The infection chain began with multiple Telnet connections to our honeypots, followed by credential brute-force attempts...

Discovery

1 technique

T1082System Information DiscoveryEvidence1

...sending the host’s OS and architecture... On connection, it authenticates with the hardcoded string “ChangeMe123!” and identifies the infected system’s hostname and user.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

The infection chain began with multiple Telnet connections to our honeypots...

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence1

Impact

2 techniques

T1498Network Denial of ServiceEvidence1

T1499Endpoint Denial of ServiceEvidence1

cf : HTTP(S) flood targeting Cloudflare-protected sites... tls , tlsplus and tlsplusbypass: TLS flood attacks... http: Performs HTTP GET or POST requests against a specified URL...

INDICATORS OF COMPROMISE

IOCs tracked for this family

18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

12 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

nozomi networks blogNews

Jul 6, 2026

Spring Botnet Floods: Golang Malware Targets Exposed IoT Systems

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching18

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.