Mozi Resurfaces as Androxgh0st Botnet: Unraveling The Latest Exploitation Wave

CloudSEK’s analysis reports that the Androxgh0st botnet (active since Jan 2024) is actively exploiting a wide range of web-application and IoT vulnerabilities—leveraging more than 20 CVEs and deploying Mozi IoT payloads—to gain persistent access; the report includes C2 logs, TTP examples, IoCs (IPs and MD5 hashes), affected products, and mitigation recommendations, with low-confidence attribution to Chinese-linked actors.