New Malware Campaigns Turn Network Devices Into DDoS Nodes and Crypto-Mining Bots

Security researchers identified two new malware families—CondiBot (a Mirai-based DDoS botnet) and Monaco (an SSH brute-forcer and Monero miner)—that compromise Linux-based routers, IoT devices, and enterprise network equipment using multiple file-transfer methods, credential brute-force, and persistence techniques (disabling reboots, watchdog manipulation). The report highlights active exploitation risks to network infrastructure, minimal yet actionable indicators ("QTXBOT", "/bin/sora"), and recommends rapid patching, strong SSH credentials, and firmware integrity monitoring.