Androxgh0st

Androxgh0st, a notable threat actor in the cybersecurity landscape, has been actively targeting systems since January 2024. According to CloudSEK's Threat Research team, Androxgh0st has begun exploiting vulnerabilities in web servers, specifically targeting high-profile technologies like Cisco ASA, Atlassian JIRA, and multiple PHP frameworks. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory in early 2024 alerting organizations to Androxgh0st’s capacity for systematic exploitation across various CVEs, further emphasizing the severity of this threat. In addition to its initial activities, recent developments have revealed that Androxgh0st has integrated elements from the Mozi botnet into its operations. Despite the disruption of Mozi, command-and-control logs indicate that Mozi's payloads have been reintegrated into Androxgh0st’s botnet infrastructure. This integration has created a more extensive infection network, thereby increasing the threat actor's reach to Internet of Things (IoT) environments, a tactic previously associated with Mozi. The FBI and CISA have issued warnings about the Androxgh0st botnet, which is being used for victim identification and exploitation. Furthermore, Androxgh0st is also targeting IoT devices, continuing the tactics historically associated with Mozi, which primarily impacted routers and DVRs across China, India, and Albania before its creators were arrested in 2021. In terms of prevalence among malware families, Androxgh0st follows FakeUpdates, impacting 8% of worldwide organizations, indicating its widespread influence in the cybersecurity landscape.