Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network

A publicly exposed staging server hosted on Iranian-registered infrastructure revealed 449 files across 59 directories that fully expose a live botnet operation: a 15-node relay network, mass SSH deployment tooling (ohhhh.py), credential lists, on-host compilation of a C-based bot client (cnc.c compiled to a binary named 'hex'), DDoS source and binaries, a hardcoded C2, and management scripts including a remote kill-switch; researchers advise blocking tied IPs, monitoring filenames and hashes, hardening SSH, and alerting on unexpected gcc compilation activity.