Loading story…
The Hajime malware infected nearly 300,000 internet-connected devices by combining multiple compromise methods against routers, cameras, DVRs, and cable modems. Researchers reported that the worm spread through Telnet default-password attacks, added a TR-069 exploitation module for remote code execution, and abused an Arris cable modem password-of-the-day mechanism, allowing it to compromise vulnerable IoT systems at scale. The botnet used a peer-to-peer architecture and tailored downloader binaries to victim device architectures and WAN interfaces, while also refining banner-based brute-forcing and architecture detection to improve infection success.
Victimology data showed broad global exposure, with the highest concentrations of infected hosts observed in Iran, Brazil, Vietnam, Russia, and Turkey. DHT leecher analysis identified 297,499 unique infected hosts, and honeypot telemetry indicated many victims were consumer and small-office embedded devices. Despite the botnet’s size and continued evolution, researchers said they had not observed Hajime being used for overt attacks at the time of reporting, leaving its ultimate purpose unclear even as it was tracked as Backdoor.Linux.Hajime.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In its June 2017 report, Kaspersky said it had not observed Hajime being used for overt attacks or other malicious activity, even as the botnet continued to expand. The company detected the malware as Backdoor.Linux.Hajime.
Kaspersky reported that Hajime had grown into a peer-to-peer botnet with 297,499 unique infected hosts identified through DHT leecher analysis, affecting many DVRs, cameras, and routers worldwide. The largest concentrations of infections were observed in Iran, Brazil, Vietnam, Russia, and Turkey.
By the time of Kaspersky's analysis, Hajime had evolved beyond Telnet default-password attacks to add a TR-069 exploitation module and an Arris cable modem password-of-the-day attack, improving its ability to compromise IoT devices via remote command execution and credential abuse.
The Hajime malware family was first publicly reported in October 2016 as an IoT worm spreading through vulnerable internet-connected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Masjesu** botnet, also tracked as **XorBot**, has been operating since early 2023 as a **DDoS-for-hire** service promoted on Telegram. The malware targets internet-exposed routers, gateways, cameras, DVRs, NVRs, and other embedded devices across multiple CPU architectures, exploiting known command-injection and remote code execution flaws in products from vendors including **D-Link, Huawei, NETGEAR, TP-Link, and GPON**. Trellix said the botnet is engineered for stealth and longevity, using XOR-based obfuscation, runtime decryption, persistence mechanisms, process spoofing, and multi-domain command-and-control infrastructure with fallback IPs. Once installed, Masjesu opens a hard-coded TCP port `55988` for direct operator access, suppresses termination signals, kills utilities such as `wget` and `curl`, and connects to external servers for attack instructions. The operators reportedly avoid scanning or infecting high-profile ranges such as **U.S. Department of Defense** networks to reduce scrutiny, while advertising the botnet's geographic spread and attack capacity. Observed traffic has been concentrated in **Vietnam** and also seen from **Ukraine, Iran, Brazil, Kenya, and India**, with the botnet used to launch **TCP, UDP, and HTTP flood** attacks against CDNs, game servers, and enterprises, including volumes reported at roughly **290 Gbps**.
Jun 29, 2026
Internet Storm Center (ISC) researchers reported a **self-propagating SSH worm** observed by a DShield honeypot sensor that can compromise exposed Linux systems in roughly **four seconds** by using **credential stuffing/brute force** against weak SSH passwords, with a notable focus on *Raspberry Pi* devices left on default or common credentials (e.g., user `pi` with passwords such as `raspberry` and `raspberryraspberry993311`). The observed attack chain rapidly authenticates, uploads a compact **4.7 KB bash script** (via SCP), executes it, and establishes persistence while removing competing malware, enabling worm-like exponential spread across vulnerable internet-connected hosts. Technical analysis indicates the activity likely originated from an already-compromised *Raspberry Pi* in Germany (IP `83.135.10.12`, Versatel Deutschland), using an SSH client string consistent with Raspbian (`SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1`) and a recorded HASSH fingerprint `ae8bd7dd09970555aa4c6ed22adbbf56`. Post-compromise, the malware connects to **IRC-based command-and-control** and includes **cryptographically signed command verification**; it also automates scanning and lateral movement using tools such as **Zmap** and **sshpass**, reinforcing how default/weak SSH authentication on IoT and small-form-factor Linux systems remains a high-impact botnet entry point.
Jun 29, 2026
The **Mirai** malware turned insecure internet-connected devices into massive DDoS botnets that powered some of the largest attacks publicly reported, including floods against **OVH**, **KrebsOnSecurity**, and DNS provider **Dyn**. The botnet spread by logging into exposed IoT devices such as cameras, DVRs, routers, and gateways with hardcoded or default credentials, and defenders later warned that products including certain **Sierra Wireless AirLink** gateways could be conscripted if factory passwords were left unchanged. After the malware’s source code was released publicly under the alias **"Anna-senpai"**, multiple actors were able to build copycat botnets, increasing attack volume and complicating attribution. The Dyn attack disrupted access to major online services including **Twitter, Spotify, Reddit, GitHub, Airbnb, Shopify, SoundCloud, and The New York Times**, with Dyn describing a highly distributed, adaptive campaign delivered in several waves from vast numbers of IP addresses. Investigative reporting tied Mirai’s origins to the DDoS-for-hire and Minecraft-hosting ecosystem and presented evidence linking the **Anna-senpai** persona to **Paras Jha** and associates, while later reporting showed Mirai variants continued launching attacks long after the original incidents. Researchers identified limited countermeasures, including crashing some bots via a flaw in Mirai’s HTTP flood code and traceback methods for DNS amplification traffic, but the broader risk persisted because vulnerable IoT devices remained widely deployed and malware authors could quickly adapt.
Jun 29, 2026