New Botnet ‘Loader-as-a-Service’ Turns Home Routers and IoT into Mirai Farms
CloudSEK has identified a Loader-as-a-Service botnet campaign that has been active over the past six months. The campaign utilizes exposed command-and-control logs to orchestrate attacks targeting SOHO routers, embedded Linux devices, and enterprise…
CloudSEK has identified a Loader-as-a-Service botnet campaign that has been active over the past six months. The campaign utilizes exposed command-and-control logs to orchestrate attacks targeting SOHO routers, embedded Linux devices, and enterprise applications.
The threat actors exploit unsanitized POST parameters, including NTP, syslog, and hostname fields, as well as default credentials and known CVEs in WebLogic, WordPress, and vBulletin systems, to achieve remote code execution. During July and August 2025, attack volumes increased by 230%, deploying multi-architecture malware such as Morte binaries and cryptomining payloads. CloudSEK has informed affected customers whose technology stacks align with the targeted vectors.
CloudSEK’s TRIAD team first identified the operation during routine scans for malicious infrastructure. The exposed control panel logs revealed a methodical sequence of modules, each corresponding to a stage in the attack chain.
Oracle WebLogic servers via console/servlet RCE. SOHO routers through vulnerable UI pages and unsanitized fields. Embedded Linux devices by deploying multi-architecture binaries. CMS platforms via known CVEs, including CVE-2019-17574, CVE-2019-16759, and CVE-2012-1823.
Attackers employ multiple protocols for payload delivery, including HTTP, TFTP, and FTP, with BusyBox wrappers for compatibility across device types. Default credentials and automated sprays facilitate initial access, while redundant drop hosts ensure resilience against takedowns.
Enterprise Targeting: The use of WebLogic deserialization, Struts2 OGNL injection, and JNDI exploits increases the risk of data exfiltration, lateral network movement, and secondary payloads such as ransomware.
CloudSEK has identified a Loader-as-a-Service botnet campaign that has been active over the past six months.
Infrastructure Compromise: Corporate edge routers face bandwidth exhaustion, time-sensitive system disruption, and DNS manipulation.
Third-Party Risk: Small business routers and IoT devices serve as platforms for attacks against enterprise clients, while compromised service-provider infrastructure can amplify reach.
Egress Blocking: Deny outbound HTTP, HTTPS, TFTP, and FTP from IoT segments. Inventory & Isolation: Identify internet-exposed admin UIs and isolate devices showing injected POST patterns. Credential & Firmware Updates: Enforce unique credentials, apply vendor patches, and disable unnecessary remote management features.
Implement Sigma rules to detect suspicious POST parameters containing wget , curl , or |sh . Deploy Suricata/Snort regex alerts for download-and-execute patterns in HTTP bodies. Monitor for unusual JSON-RPC traffic indicating cryptomining activity.
Enforce strict egress filtering to allow only whitelisted update servers for firmware and NTP. Segment IoT and embedded devices from core production networks. Harden web UIs behind VPN or jump-box access.
Quarantine devices exhibiting outbound mining or unexpected /tmp/morte.* executions. Collect forensic artifacts: shell command logs, process trees, and temporary filesystem contents. Reimage or replace unpatchable devices to restore integrity.
CloudSEK forecasts continued evolution of this Loader-as-a-Service operation, with expanded device targeting and payload sophistication. Vigilant monitoring, rapid remediation, and layered defense strategies are critical to mitigate this emerging threat.
Based on reporting by GBHackers.