Mozi

Mozi, a malicious software (malware), has been a significant force in the cyber threat landscape. This malware, known for exploiting outdated and vulnerable Internet of Things (IoT) devices, was responsible for 74% of all IoT attacks in 2021. The Mozi botnet, infamous for hijacking hundreds of thousands of internet-connected devices each year, saw significant growth since Q3 2021, with over 5 million detections in the early months of 2022. Most of the malware samples detected were from well-known malware families like Mirai, Gafgyt, and Mozi. Despite disruption efforts, recent logs from command-and-control operations by Androxgh0st suggest that Mozi's payloads have been reintegrated into its botnet infrastructure. This reintegration has resulted in an extensive infection network, increasing the threat’s reach to IoT environments. Further analysis revealed that Androxgh0st is also targeting IoT devices, a tactic historically associated with Mozi. This activity primarily impacted routers and DVRs across China, India, and Albania before the creators of Mozi were arrested in 2021. There are emerging concerns about a potential operational alliance between the Androxgh0st and Mozi botnets. Significant developments in the Androxgh0st botnet reveal strategic expansion and integration with elements from the Mozi botnet, including deploying Mozi’s IoT-focused payloads. However, it remains unclear who is behind the Mozi Botnet kill switch, which could potentially mitigate the threat posed by these combined forces.