Malware Analysis of the DreamBus Botnet

**Executive Summary:** Zscaler ThreatLabZ analyzed DreamBus, a modular, worm-like Linux botnet (SystemdMiner variant) that spreads via SSH brute-force, weak credentials, and multiple unauthenticated RCE exploits (PostgreSQL, Redis, Hadoop YARN, Apache Spark, Consul, SaltStack). The report provides in-depth TTPs, IOCs (hashes, domains, IPs, filenames), detection signatures (YARA/Snort), and notes current monetization via XMRig Monero mining while warning the actor could pivot to more destructive activity.