VERY IMPORTANT

A sophisticated botnet operation employing a Loader-as-a-Service model was uncovered through exposed command and control logs spanning six months. The campaign systematically targets SOHO routers, IoT devices, and enterprise applications through command injection vulnerabilities in web interfaces. Key attack vectors include exploiting unsanitized POST parameters, leveraging default credentials, and targeting known CVEs in various systems. The operation showed a 230% attack spike from July-August 2025, deploying multi-architecture malware including Morte binaries and cryptomining payloads. With rapid infrastructure rotation and diverse malware, the threat is evolving rapidly, necessitating early detection and robust defense measures.