CloudSEK Finds Botnet Loader Service Distributing RondoDoX, Mirai and Morte Payloads

Sep 25, 2025 · Original article ↗

Summary

CloudSEK analyzed six months of exposed botnet logs showing attacks on routers, IoT devices and enterprise applications, including command injection, default-credential attempts and delivery of RondoDoX, Mirai and Morte payloads.

Key points

The operation targeted SOHO routers, embedded Linux and enterprise applications, including WebLogic, WordPress and vBulletin systems.
Attack methods included command injection through web-interface fields, default credentials and exploitation of known vulnerabilities.
Logged commands show fetch-and-execute payload delivery using tools such as wget, curl, BusyBox, TFTP and FTP.
Payloads included RondoDoX, Mirai and Morte malware, as well as cryptomining components; the report describes multi-architecture binaries.
CloudSEK reported an attack spike of more than 230% from July to August 2025; threat actors later revoked access to the logger server.
CloudSEK says it alerted customers whose technology stacks overlapped with the campaign’s targeted vectors.
Recommended defenses include updating firmware, replacing default credentials, disabling unnecessary remote management, filtering egress and isolating IoT devices.

Article Details

Attack Vectors: Shell-command injection through unsanitized web-admin POST parameters, including NTP, syslog, hostname, ping, MAC, and firmware fields.
Default-credential login attempts and automated brute-force or credential-spray attempts against device administration interfaces.
Abuse of firmware-upgrade and diagnostics endpoints to execute commands or deliver payloads.
Enterprise application exploitation involving console or servlet RCE, deserialization attacks, OGNL injection attempts, and JNDI injection.
Staged delivery using shell-script downloaders followed by architecture-specific native binaries, with HTTP downloads and TFTP or FTP fallbacks.
Redundant payload-hosting infrastructure used to maintain delivery availability.
Defensive Notes: Block outbound traffic to identified malicious infrastructure and restrict router update traffic to approved servers.
Inventory exposed administration interfaces and isolate devices whose POST parameters contain injected download-and-execute commands.
Change default credentials, apply available firmware patches, and disable unnecessary remote-management functionality.
Inspect HTTP request bodies and command logs for wget or curl piped to sh, BusyBox download commands, and suspicious shell characters in administration fields.
Block unnecessary TFTP and FTP egress from IoT segments and separate IoT devices from production networks.
Investigate high CPU utilization accompanied by JSON-RPC mining traffic or connections to unknown mining endpoints.
Quarantine devices executing /tmp/morte.* or communicating with mining pools; preserve temporary files, shell-command history, and process trees for investigation.
Reimage compromised devices that cannot be patched.
Treat panel success responses as candidate-compromise evidence rather than standalone confirmation of successful payload execution.

Indicators of compromise

Type	Indicator	Context
IPV4	`152[.]89[.]170[.]51`	Identified as a Mirai downloader host.
IPV4	`160[.]187[.]246[.]150`	Identified as a Mirai downloader host.
IPV4	`176[.]65[.]142[.]122`	Identified as a Mirai downloader host.
IPV4	`196[.]251[.]117[.]179`	Identified as a Mirai downloader host.
IPV4	`196[.]251[.]66[.]32`	Identified as a RondoDoX downloader host.
IPV4	`196[.]251[.]73[.]215`	Identified as a Morte downloader host.
IPV4	`196[.]251[.]73[.]24`	Identified as a Morte downloader host.
IPV4	`220[.]158[.]234[.]135`	Identified as a Mirai downloader host.
IPV4	`38[.]59[.]219[.]27`	Identified as a RondoDoX downloader host.
IPV4	`5[.]59[.]248[.]169`	Identified as a Mirai downloader host.
IPV4	`74[.]194[.]191[.]52`	Identified as a RondoDoX downloader host.
IPV4	`80[.]66[.]75[.]121`	Identified as a Mirai downloader host.
IPV4	`83[.]252[.]42[.]112`	Identified as a RondoDoX downloader host.
SHA256	`0059634f55caf3694c56a2403cce672c2151f4df4a95a983ac4aa0250489b81d`	Mirai payload hash listed under multiple downloader hosts, including 160.187.246.150, 152.89.170.51, and 5.59.248.169.
SHA256	`0081bdf4fdd13e6d46668a998eaa02e7bb0ec8328e8b93890bc66a1f380c485b`	RondoDox payload hash listed with downloader host 196.251.66.32.
SHA256	`017e0409a066dbdb4e9bcd23c61d9291a3d54256a80448b743a4a9bba8bb9cc9`	Morte payload hash listed with downloader host 196.251.73.215.
SHA256	`0a31a2b27d64ebb90bd4da3d559f15d2063bded6e3a483c0ca5992e668701040`	Morte payload hash listed with downloader host 196.251.73.24.
SHA256	`282ada9a29a5f3144114373ef3c5826bcc8fb5018cd0f2ecb97d2a7bee1df296`	Mirai payload hash listed with downloader host 220.158.234.135.
SHA256	`b6302061d56916a2357796eee3b5b69c6e2e5286200751f6e4083f7495413c2d`	RondoDox payload hash listed with downloader host 74.194.191.52.
SHA256	`c11bce7a2a07e1da4921a97e0c73445a49130dc87bea22ca938568840f11f5fb`	RondoDoX payload hash listed with downloader host 83.252.42.112.