Open Directory Exposes 15-Node Relay Network and SSH-Deployed DDoS Botnet

Mar 17, 2026 · Original article ↗

Summary

Researchers traced an exposed Iranian-hosted directory to a 15-node relay network and an SSH-driven botnet that compiled DDoS tools on recruited hosts. The operator also used the infrastructure for censorship-bypass tunneling.

Key points

An exposed directory contained deployment scripts, configuration files, bash history, DDoS tools, and a compiled bot client.
A shared TLS certificate helped researchers identify 15 related servers, including nodes hosted in Finland and Iran.
A Python script used stored SSH credentials and up to 500 concurrent sessions to compile and launch the bot client on remote hosts.
The operator tested SYN- and UDP-flood tools and MHDDOS against two targets; the article says the motive for those attacks was unknown.
The compiled bot client registered infected hosts with a C2 server and included reconnection logic, so staging-server disruption may not remove deployed bots.
Researchers assess the operator was likely based in Iran or familiar with Farsi, but found no indication of state-directed activity.
The article recommends blocking identified infrastructure, monitoring for related files and hashes, and hardening SSH accounts.

Article Details

Attack Vectors: A deployment script reads SSH credentials in host:port|username|password format and opens up to 500 concurrent connections to recruit victim hosts.
After SSH access, the operator downloads C source from the staging directory, compiles it locally with gcc -pthread, renames the executable hex, and launches it in a detached screen session.
Custom C programs implement raw-socket SYN and UDP floods; the operator also executed proxy-configured DDoS tooling against live targets.
The same staging infrastructure supports a censorship-bypass relay network and botnet deployment, with an ingress forwarding traffic to a Finnish exit node.
Compiled bot strings indicate host registration, attack-control commands, packet counting, and automatic reconnection after C2 disconnection.
Defensive Notes: Block infrastructure indicators identified by the investigation.
Monitor for the reported malicious filenames and artifact hashes.
Monitor gcc execution on hosts where local compilation is unexpected; the operator compiles payloads on victims rather than distributing prebuilt binaries.
Harden SSH accounts and review credential-based remote access.
Treat recruited hosts as independently compromised even when C2 is unreachable; recovered strings indicate automatic reconnection.
Reassess reliance on hash-based detection, binary scanning, and source-IP attribution because the operation uses local compilation and relay infrastructure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bot[.]kilashin[.]info`	Investigation-listed infrastructure domain resolving to relay node 65.109.214[.]203.
DOMAIN	`down[.]celltoocall[.]com`	Investigation-listed infrastructure domain resolving to relay node 65.109.213[.]131.
DOMAIN	`finland1[.]server21[.]org`	Relay-network domain listed as resolving to 185.221.239[.]121.
DOMAIN	`finland2[.]server21[.]org`	Relay-network domain resolving to 185.221.239[.]84.
DOMAIN	`finland4[.]server21[.]org`	Relay-network domain listed as resolving to 185.221.239[.]198.
DOMAIN	`finland5[.]server21[.]org`	Investigation-listed infrastructure domain resolving to the botnet staging and C2 server.
DOMAIN	`finland6[.]server21[.]org`	Relay-network domain resolving to 185.221.239[.]160.
DOMAIN	`hzf09853311[.]xyz`	Domain explicitly listed among infrastructure indicators from the botnet investigation.
DOMAIN	`parsashonam-sub[.]blog`	Domain explicitly listed among infrastructure indicators from the botnet investigation.
DOMAIN	`re[.]dangidog[.]site`	Domain explicitly listed among infrastructure indicators from the botnet investigation.
DOMAIN	`robot5[.]server21[.]org`	Domain associated with the suspected additional relay node at 212.74.39[.]128.
DOMAIN	`server21[.]org`	Domain used for the investigated relay network and its node naming scheme.
DOMAIN	`sir[.]ffakhar[.]ir`	Investigation-listed infrastructure domain resolving to 194.147.222[.]183.
IPV4	`185[.]221[.]239[.]121`	Relay-network infrastructure sharing the TLS certificate; associated with finland1.server21[.]org.
IPV4	`185[.]221[.]239[.]160`	Relay-network infrastructure sharing the TLS certificate; associated with finland6.server21[.]org.
IPV4	`185[.]221[.]239[.]162`	Exposed botnet staging server and hardcoded bot C2; also serves as the tunnel ingress.
IPV4	`185[.]221[.]239[.]188`	Investigation-listed relay-network infrastructure sharing the TLS certificate.
IPV4	`185[.]221[.]239[.]198`	Address listed as the resolution destination of relay-network domain finland4.server21[.]org.
IPV4	`185[.]221[.]239[.]84`	Relay-network infrastructure sharing the TLS certificate; associated with finland2.server21[.]org.
IPV4	`185[.]236[.]38[.]79`	Investigation-listed relay-network infrastructure sharing the TLS certificate.
IPV4	`185[.]236[.]38[.]81`	Investigation-listed relay-network infrastructure sharing the TLS certificate.
IPV4	`194[.]147[.]222[.]183`	Investigation-listed relay-network infrastructure sharing the TLS certificate.
IPV4	`212[.]74[.]39[.]128`	Suspected additional relay node associated with a second certificate and robot5.server21[.]org.
IPV4	`65[.]109[.]184[.]58`	Investigation-listed relay-network infrastructure sharing the TLS certificate.
IPV4	`65[.]109[.]187[.]102`	Relay-network node sharing the TLS certificate; configured as the tunnel exit for the staging server.
IPV4	`65[.]109[.]196[.]138`	Finnish relay-network node linked through the shared TLS certificate.
IPV4	`65[.]109[.]204[.]0`	Finnish relay-network node linked through the shared TLS certificate.
IPV4	`65[.]109[.]209[.]147`	Finnish relay-network node linked through the shared TLS certificate.
IPV4	`65[.]109[.]213[.]131`	Investigation-listed relay node sharing the TLS certificate; associated with down.celltoocall[.]com.
IPV4	`65[.]109[.]214[.]203`	Investigation-listed relay-network infrastructure sharing the TLS certificate.
SHA256	`1e3a7e978953bbe040cc5e0743b926fe3407ab949370b791d2de6655a704ef73`	Hash of yse.py, the botnet management script that kills screen processes across recruited hosts.
SHA256	`5c41c075bfb1fcb85095b539e0c97a07c62379518ae1289677b118c550afb5d0`	Second TLS certificate fingerprint associated with suspected relay expansion at 212.74.39[.]128.
SHA256	`73048cb6506443e482935586edb2af3f6a0c8ca44b061172b5be826a0f1e92f6`	Hash of cnc, the compiled bot client recovered during the investigation.
SHA256	`acfd59afbb50331925cc3980e7c40044807e0a8bf44e0c38f9f0af9988ea060e`	Hash of ohhhh.py, the credential-driven SSH bot deployment script.
SHA256	`ba318b710978c277a1ad6f2de81d7d2402607036d0c0e777ec75bc6b6e428974`	TLS certificate fingerprint used to identify servers in the operator's relay network.