Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks

Muhstik botnet operators are actively exploiting a critical Apache RocketMQ RCE (CVE-2023-33246, CVSS 9.8) to deploy a Linux/IoT-focused malware (binary named "pty3") that establishes persistence, performs lateral movement via SSH, phones home over IRC, and is used for DDoS and cryptomining; over 5,200 RocketMQ instances remain exposed. The report also highlights attackers targeting poorly secured MS-SQL servers via brute-force, urging patching and stronger passwords.