Exposed Directory Reveals Active Moobot Operations and DDoS Tools
Summary
Censys found Moobot source code, DDoS tooling, attack records, and a fraudulent identity-verification service in an exposed directory. The recovered code contains dormant download-and-execute functionality, and monitoring indicates ongoing Moobot activity.
Key points
- The directory exposed a Moobot source tree, a DDoS management panel, attack logs, and a Chinese-themed identity-verification service.
- Recovered code includes dormant download-and-execute routines that could let a C2 operator deploy payloads to infected devices.
- The separate DDoS panel recorded 32 attacks from six customers; its Minecraft Bedrock flooder generates traffic from the host rather than the Moobot botnet.
- The panel collected customer IP addresses, browser and device details, and other fingerprinting data.
- The identity-verification service forwarded submitted names and national ID numbers to a third-party lookup API.
- Censys reported observing one linked Moobot C2 server and more than 500 short-duration attack taskings during August 2026.
- The report says the observed activity appears financially motivated and assesses no state-sponsored nexus.
Article Details
- Attack Vectors
- Moobot spreads across low-security network devices and communicates with infected systems through a custom C2 protocol.
- Dormant Moobot code can request an architecture-specific payload from a hardcoded IP address over HTTP, then write it as an executable, rename it, fork, and execute it.
- StresD Pro+ launches denial-of-service attacks directly from its server using a Python Minecraft Bedrock Edition RakNet flooder.
- The identity-verification panel submits names and Chinese national ID numbers to a third-party lookup API.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 162[.]141[.]92[.]192 | Observed active Moobot C2 server, receiving attack tasking over TCP/14123. |
| IPV4 | 86[.]53[.]111[.]212 | Host exposing the directory containing Moobot source code and associated operation files. |
MITRE ATT&CK
T1095 · Non-Application Layer ProtocolMoobot communicates with infected systems using a custom protocol variant for C2.T1105 · Ingress Tool TransferDormant Moobot functionality downloads an architecture-specific payload over HTTP from a hardcoded IP address.T1498.001 · Direct Network FloodStresD Pro+ uses a RakNet flooder to send malformed encapsulated packets and randomized NACK sequences at targets.
Threat Actors
Malware
Miraidirectory (86.53.111[.]212), exposed on 30 July 2026, held the source code for Moobot, a variant of the Mirai DDoS malware, alongside additional DDoS tools and a suspected fraudulent Chinese ID verification service.MooBotopen directory on 86.53.111[.]212:8080 exposed critical details of active cybercrime operator, including Moobot botnet source code, other denial of service (DOS) tools with attack records, and a fraudulent identity
Tools
Minecraft Bedrock Edition RakNet flooderThe panel operates independently from the Moobot, generating attack traffic directly from the staging host using a purpose-built Minecraft Bedrock Edition RakNet flooder.StresD Pro+Also present on the host is “StresD Pro+”, a multi-user DDoS panel with 16 registered accounts and 32 recorded attacks on the day of collection.