Posts tagged TheMoon Botnet
TheMoon Botnet

Discovered as a worm in 2014, TheMoon was observed by a researcher at the SANS Internet Storm Center spreading itself to a large number of Linksys router models. Delivered in the form of a 2 MB ELF MIPS binary, it connects to port 8080 and then, after determining the versions of hardware and firmware, it sends an exploit to a vulnerable CGI script running on the targeted router.

Read More