Masjesu Botnet Emerges as DDoS-for-Hire Service Targeting Global IoT Devices

Researchers from Trellix and NSFOCUS have analyzed Masjesu (aka XorBot), a stealthy IoT botnet marketed on Telegram since 2023 that compromises routers, cameras, DVRs/NVRs and other devices via numerous command-injection and code-execution exploits, establishes persistence by binding a hard-coded TCP port (55988), uses XOR-based obfuscation, self-propagates (including scanning Realtek port 52869), and is used to conduct volumetric DDoS attacks targeting CDNs, game servers and enterprises while deliberately avoiding sensitive IP ranges to increase survivability.