New CondiBot Variant and ‘Monaco’ Miner Target More Network Devices

Over the past few years, the enterprise attack surface has shifted decisively toward network infrastructure, with attackers increasingly abusing routers, VPNs, firewalls, and other edge devices for initial access and long‑term persistence.

Research from Verizon and others has documented an almost eight‑fold rise in exploitation of network and edge devices in recent years, with these flaws now implicated in over one‑fifth of breaches.

At the same time, Google’s threat intelligence teams report that nearly a quarter of zero‑day vulnerabilities exploited in 2025 targeted network and security technologies specifically, underscoring how critical these devices have become in modern intrusion chains.

The latest Google Cloud Threat Horizons report further notes that exploitation of third‑party software vulnerabilities has now surpassed weak credentials as an initial access vector, signaling a broader shift toward software‑driven network compromise.

Network devices are attractive because they sit at high‑leverage points in the environment and often run opaque, embedded operating systems that cannot host traditional EDR agents.

Eclypsium’s latest findings on a new CondiBot variant and the “Monaco” cryptominer show that this activity is no longer confined to advanced APTs, but now also fuels financially motivated botnets and cryptojacking campaigns.

Once compromised at the firmware or OS level, attackers can maintain durable persistence, survive reboots and re‑imaging, and use the device as a strategic pivot for lateral movement and traffic interception.

New CondiBot variant

On March 6, 2026, Eclypsium captured a previously undocumented CondiBot sample, an evolution of the Mirai‑derived Condi DDoS botnet designed to conscript Linux‑based devices into large‑scale attack infrastructure.

The binary is a multi‑architecture ELF “executor” that supports arm, arm5, arm6, arm7, mips, x86, and x86_64 builds, enabling it to run across a wide variety of routers, IoT gear, and network appliances not just Fortinet platforms.

The bot uses a robust payload delivery routine, cycling through wget, curl, tftp, and ftpget to pull down the appropriate architecture payload, then disables reboot utilities, manipulates the hardware watchdog, and kills competing botnets to maintain control.

Once registered with its (now inactive) C2 at 65.222.202.53 over port 80, the malware waits in a select() loop for commands and can invoke 32 distinct attack handlers, suggesting an expanded range of DDoS flood techniques compared to earlier Condi reporting.

Notably, an embedded “QTXBOT” identifier and a new process kill list entry for /bin/sora point to either a forked lineage or ongoing development by the threat actor.

Alongside CondiBot, Eclypsium analyzed “Monaco,” a Go 1.24.0‑based SSH scanner and Monero cryptominer that systematically brute‑force SSH servers across roughly 3.6 billion routable IPs.

The malware ships as statically linked ELF executables for x86‑64, ARM32, ARM64, and MIPS in both endian variants, enabling it to compromise traditional servers, IoT devices, routers, and even Juniper network equipment.

Monaco uses a hardcoded wordlist of more than 50 weak credentials (including “root,” “admin,” “ubuntu,” “postgres,” and simple numeric patterns) to gain access, then copies itself into /tmp/monaco or /tmp/nice, sets permissive permissions, kills rival miners, tunes CPU settings, and deploys XMRig/XMRigCC to mine Monero via the MoneroOcean pool.

Compromised SSH credentials are sent back to a C2 infrastructure hosted on Alibaba Cloud (8.222.206.6), which exposes multiple services: Apache file hosting on port 80, a mining proxy on 3333, and separate “nice” and “monaco” command‑and‑control channels on ports 12345 and 12346.

Open directory listings, debug builds, and default tokens left on the server point to a relatively low‑sophistication, likely Chinese‑speaking actor focused on scale over stealth.

Network devices as a structural weak point

These campaigns play into a clear structural imbalance: most enterprises still lack deep visibility into the firmware and low‑level software running on their network and security appliances.

Attackers exploit this “visibility gap” to gain zero‑click initial access via exposed VPNs or gateways, persist below the operating system, and then bridge segments or IT/OT boundaries from compromised switches and firewalls.

Eclypsium notes that these new CondiBot and Monaco samples sit within a multi‑year rise in network‑device‑focused operations, spanning APT espionage, ransomware affiliates, and now cryptomining operators.

To counter this, defenders are urged to extend monitoring and threat detection to routers, firewalls, VPNs, and other edge devices treating them as critical endpoints rather than opaque infrastructure that exists outside traditional security controls.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.