logo

Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption

ID: 671d27c8-726f-59fc-85f7-149430a5d251

STIX ID: report--671d27c8-726f-59fc-85f7-149430a5d251

Feed Name: Censys Blog

Threat Score
72/100

Date Published: 2026-08-27

Date Updated: 2026-10-10

...
...

**Executive Summary:** An open directory on 86.53.111.212 exposed Moobot (a Mirai-derived IoT botnet) source code, a StresD Pro+ DDoS management panel with active user accounts and attack logs, and a fake Chinese government ID verification service; recovered artifacts include C2 protocol details, hardcoded credentials, user fingerprints, and a dormant download-and-execute routine that could enable arbitrary payload deployment and help explain reported APT28 repurposing.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.