Summary: The Androxgh0st botnet has expanded its operations by integrating elements from the Mozi botnet, targeting web servers and exploiting high-profile vulnerabilities. Recent findings highlight its capability to infiltrate systems and raise concerns about its impact on IoT devices.
Threat Actor: Androxgh0st | Androxgh0st
Victim: Various organizations | various organizations
Key Point :
- Androxgh0st has been active since January 2024, exploiting vulnerabilities in technologies like Cisco ASA and Atlassian JIRA.
- The botnet is now targeting IoT devices, leveraging payloads from the previously disrupted Mozi botnet.
- CISA has issued advisories regarding Androxgh0st’s systematic exploitation of various CVEs.
- Organizations are urged to patch vulnerabilities and conduct regular system checks to mitigate risks.

Significant developments have emerged in the Androxgh0st botnet, revealing its strategic expansion and integration with elements from the Mozi botnet.
CloudSEK’s Threat Research team today published a new report highlighting that Androxgh0st, active since January 2024, has begun to target web servers, exploiting vulnerabilities to infiltrate systems.
The findings show that this botnet is also deployingMozi’s Internet of Things (IoT)-focused payloads, raising concerns about a potential operational alliance between the two botnets.
Exploiting High-Profile Vulnerabilities in Major Technologies
According to CloudSEK’s investigation, Androxgh0st leverages various vulnerabilities in high-profile technologies like Cisco ASA, Atlassian JIRA and multiple PHP frameworks. These vulnerabilities grant unauthorized access and facilitate remote code execution, allowing attackers to maintain persistent control over compromised systems.
The US Cybersecurity and Infrastructure Security Agency (CISA)issued an advisory in early 2024, alerting organizations to Androxgh0st’s capacity for systematic exploitation across various CVEs.
Key CVEs Used by Androxgh0st to Infiltrate Systems
Key vulnerabilities identified in Androxgh0st targets include:
Further analysis by CloudSEK revealed that Androxgh0st is also targeting IoT devices, a tactic historically associated with Mozi, which primarily impacted routers and DVRs across China, India and Albania before its creators were arrested in 2021.
Read more on IoT security: Half of IT Leaders Identify IoT as Security Weak Point
Despite Mozi’s disruption, Androxgh0st’s recent command-and-control logs suggest that Mozi’s payloads have been reintegrated into its botnet infrastructure, creating a more extensive infection network and increasing the threat’s reach to IoT environments.
Recommendations to Mitigate Androxgh0st Threat
To mitigate the risks posed by Androxgh0st, CloudSEK advises organizations to immediately patch affected software and network vulnerabilities. Regular system checks, vulnerability scans and updates are also essential in addressing these threats.
Source: https://www.infosecurity-magazine.com/news/androxgh0st-botnet-adopts-mozi