Honeypot logs reveal layered IoT botnet campaigns
DShield honeypot analysis exposes tiered IoT botnet activity: commodity campaigns like Terrabot and r00ts3c exploit legacy router CVEs with flawed automation, while RondoDox deploys sophisticated fileless payloads targeting enterprise infrastructure.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2016-20017, CVE-2018-10561, and CVE-2021-44228 as exploited in the wild.
A SANS ISC intern's analysis of DShield honeypot logs over 30 days reveals a multi-tiered automated threat ecosystem targeting IoT devices and enterprise systems. At the commodity layer, Terrabot and r00ts3c botnets—both Mirai/Gafgyt derivatives—scan for legacy vulnerabilities in GPON routers, D-Link DSL gateways, Linksys routers, and CCTV DVRs (CVE-2018-10561, CVE-2016-20017, CVE-2025-34037, CVE-2016-20016). These campaigns exhibit technical sloppiness: malformed HTTP requests, unencoded URL spaces causing 400 errors, hardcoded loopback/test IPs in headers, and empty POST bodies that prevent exploit delivery. Despite engineering failures, operators weaponize volume and automation to find unpatched devices, with r00ts3c demonstrating tactical maturity through targeted binary eviction and architecture-specific payloads (kaizen.arm, kaizen.mpsl).
Beneath this surface noise, the RondoDox botnet operates with enterprise-grade sophistication across three campaign phases. Beginning May 2, RondoDox targeted Log4Shell with WAF-evasion techniques (obfuscated JNDI strings in HTTP headers), ShadowRay API endpoints (CVE-2023-48022), and high-value enterprise/AI frameworks using fileless execution chains. Mid-campaign infrastructure rotation (C2 shift from 45.92.1.50 to 204.10.194.134) demonstrates centralized coordination, while the final phase revealed residential DHCP lease patterns and scanning activity correlated with Auckland waking hours—evidence that compromised home routers now constitute botnet infrastructure. Attack timing irregularity and household activity patterns confirm the Mirai replication model: victim routers become scanners hunting identical targets.
The research underscores that automated scanning is not monolithic static but a competitive shadow economy with supply chains, payload management, and operational rhythms. Threat actors exploit the gap between what defenders monitor and what they assume is benign, weaponizing decades-old CVEs through high-volume automation that outpaces patching cycles. The infrastructure persists and evolves—campaigns rotate C2 nodes, update payloads on infected devices remotely, and blur commodity/advanced categories by using identical disposable infrastructure for both consumer IoT and enterprise exploitation. For defenders, recognizing structural shifts within background noise is essential to keeping pace with perpetual, multi-directional automated threats.
Mentioned in this report
Detection guidance
Obfuscated JNDI Log4Shell Exploitation Attempt in HTTP Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects WAF-evasion style obfuscated JNDI lookup strings (e.g. nested ${lower:} or case-mixed ${jndi:) in HTTP request fields, consistent with Log4Shell exploitation observed in the RondoDox campaign. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Obfuscated JNDI Log4Shell Exploitation Attempt in HTTP Request
id: e3fb8fbc-80c6-59ab-b454-075cb25841b9
status: experimental
description: Detects obfuscated JNDI lookup patterns (nested substitution tricks like
${lower:j}ndi or mixed-case ${JnDi:) used to bypass WAF signatures for Log4Shell
(CVE-2021-44228) exploitation, as observed in RondoDox botnet activity.
references:
- SANS ISC honeypot report on RondoDox/Terrabot/r00ts3c campaigns
logsource:
category: webserver
detection:
selection_direct:
cs-uri-query|contains: '${jndi:'
selection_obfuscated:
cs-uri-query|re: \$\{[a-zA-Z]*:[a-zA-Z]*\}.*jndi
selection_header:
cs-user-agent|contains: '${jndi:'
condition: selection_direct or selection_obfuscated or selection_header
falsepositives:
- Security scanners or vulnerability assessment tools intentionally testing for Log4Shell
- Automated pentest frameworks replaying known JNDI payload strings
level: high
tags:
- attack.t1027.010
- attack.t1190
author: Vorant
IoT Botnet Payload Retrieval and Architecture-Specific Binary Execution via Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell command chains that download an architecture-specific binary (arm/mips/mpsl/x86 etc.), mark it executable, and run it - a pattern consistent with Mirai/Gafgyt-derivative botnets (Terrabot, r00ts3c) deploying payloads like kaizen.arm/kaizen.mpsl on compromised IoT devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IoT Botnet Payload Retrieval and Architecture-Specific Binary Execution via
Shell
id: b539a880-2525-501d-bc24-30ff0bf774ae
status: experimental
description: Detects wget/curl/tftp retrieval of architecture-specific ELF payloads
followed by chmod +x and execution, a hallmark of Mirai/Gafgyt-derived IoT botnet
infection chains (Terrabot, r00ts3c).
references:
- SANS ISC honeypot report on RondoDox/Terrabot/r00ts3c campaigns
logsource:
category: process_creation
product: linux
detection:
selection_download:
CommandLine|re: (wget|curl|tftp)\s+.*\.(arm[0-9]?|mips|mipsel|mpsl|x86|sh4|spc|arc|m68k)(\s|$)
selection_chain:
CommandLine|contains|all:
- chmod
- +x
selection_exec:
CommandLine|re: \./[A-Za-z0-9_.\-]+\s*$
condition: selection_download and (selection_chain or selection_exec)
falsepositives:
- Legitimate firmware update scripts on embedded/IoT devices that download and execute
vendor binaries
- CI/CD or provisioning tooling that fetches architecture-specific build artifacts
level: high
tags:
- attack.t1059.004
- attack.t1203
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, and Elastic. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33104
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs