Who killed Mozi? Finally putting the IoT zombie botnet in its grave

ESET Research describes how a signed control payload (a kill switch) was used in August–September 2023 to disable much of the Mozi IoT botnet’s functionality by killing processes, disabling services, replacing binaries, altering device configuration, and blocking ports; the report includes two control payload variants, associated SHA‑1 file hashes, a hosting IP, MITRE ATT&CK mappings, and a hypothesis that the takedown was performed either by the botnet authors or by Chinese law enforcement.