CloudSEK Investigates Doorway Botnet Targeting IoT Devices and Servers

Oct 28, 2026 · Original article ↗

Summary

CloudSEK analyzed exposed Doorway workspaces, finding a Rust exploitation engine, staged loaders and evidence of compromised devices and Java services. The final clients' capabilities and large-scale RouterOS reverse-shell deployment remain unconfirmed.

Key points

Two byte-identical exposed workspaces contained about 41 GB of operational material, including a Rust engine with 59 exploit modules targeting network devices and Java services.
The engine fingerprints targets, performs read-only probes and uses default or learned credentials alongside exploitation modules before attempting payload delivery.
Architecture-aware loaders use multiple delivery methods, while optional IP-bound HMAC signatures restrict payload retrieval to the intended address.
Recovered evidence includes 20 Jenkins hosts with confirmed remote code execution and 16 Openfire plugin uploads across non-lab targets.
A RouterOS-specific stage2.so implant beacons and attempts to open a reverse shell, but the available field log does not establish successful execution or large-scale deployment through that branch.
The operator's ledger reports 11,363 joins and 58,920 fetches in a 60-minute window; the final clients' tasking and complete command-and-control behavior remain unknown.
Defensive opportunities include monitoring for the scanner's 'Hello World' user agent, suspicious ICMP beacons, unauthorized Openfire plugins and unexpected RouterOS SOCKS configurations.

Article Details

Attack Vectors: Automated scanning and fingerprinting of exposed devices and Java services, followed by target-specific exploitation.
Default and previously exposed credentials used to authenticate to network devices.
Command injection, path traversal, configuration manipulation, and malicious plugin uploads used to deliver architecture-specific payloads.
A RouterOS exploitation chain targeted CVE-2023-30799, although the recovered field log did not establish successful execution through that branch.
Defensive Notes: Block the identified delivery, beacon, and scanning infrastructure and preserve network, DNS, proxy, and firewall logs.
Hunt for ICMP beacons and TCP/4444 connections to the primary beacon receiver, suspicious NFS mounts, and GET requests using the Hello World User-Agent.
Restrict internet-facing device administration, rotate default and reused credentials, and monitor authentication attempts and subsequent configuration changes.
Audit RouterOS SOCKS configurations, unexpected accounts and stage2.so references; patch or isolate exposed Java services and review Openfire plugins.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`19z[.]in`	Short-domain payload delivery alternative used alongside direct-IP delivery.
DOMAIN	`45[.]205[.]1[.]9[.]sslip[.]io`	Openfire SSRF persona associated with the operation's beacon address.
DOMAIN	`fd6[.]eu`	Short domain used for payload delivery through character-limited injection sinks; later recorded as NXDOMAIN.
IPV4	`16[.]5[.]0[.]225`	Attacker staging mirror and member of the scanning source pool.
IPV4	`16[.]5[.]0[.]226`	Attacker staging mirror containing artifacts identical to the other mirror.
IPV4	`16[.]5[.]0[.]241`	Scan server identified in the operation's infrastructure.
IPV4	`176[.]98[.]182[.]21`	Secondary beacon address named in the deployment ledger.
IPV4	`184[.]174[.]96[.]216`	Probe host identified in the operation's infrastructure.
IPV4	`45[.]205[.]1[.]9`	Primary ICMP execution-beacon receiver and stage2.so reverse-shell endpoint.
IPV4	`45[.]90[.]13[.]11`	NFS server used as an alternative payload delivery path.
IPV4	`45[.]90[.]13[.]169`	Payload fileserver used by the Openfire plugin and RouterOS delivery scripts.
IPV4	`46[.]246[.]97[.]179`	Retired payload host retained as the Openfire plugin builder's default payload base.
SHA256	`1fc4d07f44b576cfa77092c143d432cb089ce10ed38ac7559e77ae6b4c85b509`	Malicious ofvalid.jar Openfire plugin that retrieves and executes a client.
SHA256	`4f3bac31caf103ec8fcf47f979ce94bc35b0d295d43ebebb602e85033b2986a8`	wtg83.xml malicious Linux execution template.
SHA256	`73f67931bb28b97da3311ee5ab2babea06de82c13fec10a8298b5902e88c459f`	RouterOS stage2.so implant that beacons and attempts to open a reverse shell.
SHA256	`e07a71c229952c52008fc52dd5beb06e2e299f8d51d84ac08a5acb57f29480fd`	wtg83w.xml malicious Windows execution template.
SHA256	`f1292b5d6dd752d51bfe6bdf03f6244ac50e0fb0876e5d4e061d11c191cb5503`	wtg83 shell loader used for architecture-specific payload delivery.
SHA256	`f4e650447e879edcb7ae9b70b1a7168834414f868e924eb56358711565e07ed0`	wtg83.ps1 Windows payload loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.a64`	Architecture-specific malicious client URL requested by the wtg83 loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.arm5`	Architecture-specific malicious client URL requested by the wtg83 loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.arm7`	Architecture-specific malicious client URL requested by the wtg83 loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.mips`	Architecture-specific malicious client URL requested by the wtg83 loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.mpsl`	Architecture-specific malicious client URL requested by the wtg83 loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.ps1`	Retired server URL used to download and execute the Windows PowerShell loader.
URL	`hxxp[:]//151[.]243[.]11[.]210/wtg83.x86`	Architecture-specific malicious client URL requested by the wtg83 loader.