Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

TheMoon botnet was first identified in 2014 and it targets exploits on the router developed by companies such as Linksys, ASUS, MikroTik and D-Link.

The botnet operators used the proxy botnet for various activities such as brute forc, video advertisement fraud, general traffic obfuscation and more.

To expand the botnet the threat actor will continuously scan for vulnerable services running on IoT devices and if they detect any vulnerable device it then drops a shell script.

TheMoon botnet targets IoT applications running on port 8080 and the once the dropped shell script executed it downloads the initial stages of the payload.

Security researchers from CenturyLink found the new module is different from the previous one, the new module turns the infected device into a SOCKS5 proxy. The new module allows the botnet author to sell its proxy network as a service to others.

CenturyLink discovered that each IP hosted on TCP port 8002 When connecting to this port, a stream of log messages associated with a video advertisement fraud campaign was automatically received.

“One six-hour time period from a single server resulted in requests to 19,000 unique URLs on 2,700 unique domains. After browsing some of the URLs, it was apparent they all had embedded YouTube videos.”

The IP key has a base64 encoded string and it represents the proxy used for the video ad fraud request.

Centurylink blocked the TheMoon infrastructure on it’s ISP network and it notified another other network operators to potentially block the infected devices. Further details and IoC can be found in Century link report.

“The always-on nature of IoT devices and the ability to masquerade as normal home users make broadband networks prime targets for these types of attacks,” reads CenturyLink report.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

New Hacking Group Outlaw Distributing Botnet to Scan The Network & Perform Cryptocurrency-Mining & Brute-Force Attack

Hackers Exploiting ThinkPHP Vulnerability To Expand Hakai and Yowai Botnets

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect…

1 day ago

Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware

A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…

1 day ago

EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures

EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…

1 day ago

PoisonSeed Targets CRM and Bulk Email Providers in New Supply Chain Phishing Attack

A sophisticated phishing campaign, dubbed "PoisonSeed," has been identified targeting customer relationship management (CRM) and…

1 day ago

Beware! Fake Unpaid Tolls Messages Used in Phishing Attack to Steal Login Credentials

A surge in phishing text messages claiming unpaid tolls has been linked to a massive…

1 day ago

State Bar of Texas Confirms Data Breach, Begins Notifying Affected Consumers

The State Bar of Texas has confirmed a data breach following the detection of unauthorized…

1 day ago