The Resurgence of Moobot: An Analysis of the Infrastructure Leak

Modern cybercriminals create complex ecosystems by uniting different attack vectors on a single server. The discovered host simultaneously housed the Moobot source code, the independent DDoS attack control panel “StresD Pro+” and a fraudulent service for verifying Chinese citizens. This concentration of tools indicates optimization of the shadow business under the “crime-as-a-service” (CaaS) model. This significantly lowers the entry barrier for new criminals, allowing them to deploy large-scale attacks with minimal effort.

Research of the open directory allowed Censys company to study in detail the updated version of Moobot, which is derived from the well-known Mirai botnet. The code contains identical markers from previous campaigns, including the 0x336699 packet header and a 32-character generation key. However, the most significant finding was a previously unknown “sleeping” download-and-execute function. Researchers suggest that this function enabled the APT28 group to intercept control over the botnet to deliver its own malicious payload to already compromised devices.

Besides Moobot, the server operated the “StresD Pro+” control panel, which generates denial-of-service (DoS) traffic directly from the local server. This is done using a special Python script targeting Minecraft Bedrock Edition servers via the RakNet protocol. Another discovered service is a state ID forgery system, which resells access to a third-party API. This tool allows criminals to validate stolen personal data of citizens, expanding opportunities for further fraud.

Logs found on the server demonstrate high operator activity in real-time. In just one day, the “StresD Pro+” panel logged 32 unique attacks from different users. An interesting fact is that the service administrators meticulously collect digital fingerprints of their clients: recording IP addresses, screen parameters, number of processor cores, and browser data. As of August 2026, analysts also recorded at least one active Moobot C2 server in Amsterdam, which issued over 500 attack tasks.

The leak of Moobot code and the activity of related services prove that previously blocked threats can quickly recover thanks to the commercialization of malware. Modern businesses need to move from basic protection to proactive security architecture, which includes constant monitoring, threat intelligence, and timely detection of hidden infrastructure. Reliable protection requires a comprehensive approach and the involvement of specialized solutions.

iIT Distribution, as a distributor of cybersecurity solutions, provides a full cycle of support for partners and customers. The iITD team assists in designing security architecture, selecting optimal equipment and software to protect against complex threats. Through expert assessment, technical consultations, and specialist training, iIT Distribution becomes an integral part of the partner’s team, ensuring successful implementation and support of security projects of any complexity.