Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
ID: 671d27c8-726f-59fc-85f7-149430a5d251
STIX ID: report--671d27c8-726f-59fc-85f7-149430a5d251
Feed Name: Censys Blog
Threat Score
**Executive Summary:** An open directory on 86.53.111.212 exposed Moobot (a Mirai-derived IoT botnet) source code, a StresD Pro+ DDoS management panel with active user accounts and attack logs, and a fake Chinese government ID verification service; recovered artifacts include C2 protocol details, hardcoded credentials, user fingerprints, and a dormant download-and-execute routine that could enable arbitrary payload deployment and help explain reported APT28 repurposing.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
