Mozi Botnet

The Mozi botnet, a notorious malware, was responsible for 74% of all Internet of Things (IoT) attacks in 2021. Despite the arrest of its authors in summer 2021 leading to an overall drop in IoT attacks in Q4 of that year, the malware continued to infect more connected devices. It saw significant growth from Q3 2021, with over 5 million detections in early 2022. Furthermore, research indicated that not only were attackers rapidly using exploit code, but also quickly automated attacks by plugging into existing botnet infrastructure. Of the 19% of traffic attempting to exploit researchers' honeypots, 73% came from the Mozi botnet. In a surprising turn of events, the Mozi botnet experienced a sudden decline in activity in August 2023. Security experts who first noticed the prolific network's slowdown subsequently discovered a de facto kill switch for the IoT system. This resulted in the Mozi botnet becoming a shell of its former self. Interestingly, the bot configured ZTE and Huawei devices to prevent their exploitation, similar to previous Mozi botnet actions reported by Microsoft. Despite the demise of the Mozi botnet, significant developments have emerged in the Androxgh0st botnet, revealing its strategic expansion and integration with elements from the now-defunct Mozi botnet. However, as of the current situation, the Mozi botnet is essentially dead. An update to this persistent IoT malware was methodically pushed out starting in August, deploying first to India and then China, effectively putting the notorious botnet to rest.