Honeypot logs reveal layered IoT botnet campaigns
DShield honeypot analysis exposes tiered IoT botnet activity: commodity campaigns like Terrabot and r00ts3c exploit legacy router CVEs with flawed automation, while RondoDox deploys sophisticated fileless payloads targeting enterprise infrastructure.
A SANS ISC intern's analysis of DShield honeypot logs over 30 days reveals a multi-tiered automated threat ecosystem targeting IoT devices and enterprise systems. At the commodity layer, Terrabot and r00ts3c botnets—both Mirai/Gafgyt derivatives—scan for legacy vulnerabilities in GPON routers, D-Link DSL gateways, Linksys routers, and CCTV DVRs (CVE-2018-10561, CVE-2016-20017, CVE-2025-34037, CVE-2016-20016). These campaigns exhibit technical sloppiness: malformed HTTP requests, unencoded URL spaces causing 400 errors, hardcoded loopback/test IPs in headers, and empty POST bodies that prevent exploit delivery. Despite engineering failures, operators weaponize volume and automation to find unpatched devices, with r00ts3c demonstrating tactical maturity through targeted binary eviction and architecture-specific payloads (kaizen.arm, kaizen.mpsl).
Beneath this surface noise, the RondoDox botnet operates with enterprise-grade sophistication across three campaign phases. Beginning May 2, RondoDox targeted Log4Shell with WAF-evasion techniques (obfuscated JNDI strings in HTTP headers), ShadowRay API endpoints (CVE-2023-48022), and high-value enterprise/AI frameworks using fileless execution chains. Mid-campaign infrastructure rotation (C2 shift from 45.92.1.50 to 204.10.194.134) demonstrates centralized coordination, while the final phase revealed residential DHCP lease patterns and scanning activity correlated with Auckland waking hours—evidence that compromised home routers now constitute botnet infrastructure. Attack timing irregularity and household activity patterns confirm the Mirai replication model: victim routers become scanners hunting identical targets.
The research underscores that automated scanning is not monolithic static but a competitive shadow economy with supply chains, payload management, and operational rhythms. Threat actors exploit the gap between what defenders monitor and what they assume is benign, weaponizing decades-old CVEs through high-volume automation that outpaces patching cycles. The infrastructure persists and evolves—campaigns rotate C2 nodes, update payloads on infected devices remotely, and blur commodity/advanced categories by using identical disposable infrastructure for both consumer IoT and enterprise exploitation. For defenders, recognizing structural shifts within background noise is essential to keeping pace with perpetual, multi-directional automated threats.
Mentioned in this report
Detection guidance
Obfuscated JNDI Log4Shell Exploitation Attempt in HTTP Request
Detects WAF-evasion style obfuscated JNDI lookup strings (e.g. nested ${lower:} or case-mixed ${jndi:) in HTTP request fields, consistent with Log4Shell exploitation observed in the RondoDox campaign. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Obfuscated JNDI Log4Shell Exploitation Attempt in HTTP Request
id: e3fb8fbc-80c6-59ab-b454-075cb25841b9
status: experimental
description: Detects obfuscated JNDI lookup patterns (nested substitution tricks like
${lower:j}ndi or mixed-case ${JnDi:) used to bypass WAF signatures for Log4Shell
(CVE-2021-44228) exploitation, as observed in RondoDox botnet activity.
references:
- SANS ISC honeypot report on RondoDox/Terrabot/r00ts3c campaigns
logsource:
category: webserver
detection:
selection_direct:
cs-uri-query|contains: '${jndi:'
selection_obfuscated:
cs-uri-query|re: \$\{[a-zA-Z]*:[a-zA-Z]*\}.*jndi
selection_header:
cs-User-Agent|contains: '${jndi:'
condition: selection_direct or selection_obfuscated or selection_header
falsepositives:
- Security scanners or vulnerability assessment tools intentionally testing for Log4Shell
- Automated pentest frameworks replaying known JNDI payload strings
level: high
tags:
- attack.t1027.010
- attack.t1190
author: Vorant
IoT Botnet Payload Retrieval and Architecture-Specific Binary Execution via Shell
Detects shell command chains that download an architecture-specific binary (arm/mips/mpsl/x86 etc.), mark it executable, and run it - a pattern consistent with Mirai/Gafgyt-derivative botnets (Terrabot, r00ts3c) deploying payloads like kaizen.arm/kaizen.mpsl on compromised IoT devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IoT Botnet Payload Retrieval and Architecture-Specific Binary Execution via
Shell
id: b539a880-2525-501d-bc24-30ff0bf774ae
status: experimental
description: Detects wget/curl/tftp retrieval of architecture-specific ELF payloads
followed by chmod +x and execution, a hallmark of Mirai/Gafgyt-derived IoT botnet
infection chains (Terrabot, r00ts3c).
references:
- SANS ISC honeypot report on RondoDox/Terrabot/r00ts3c campaigns
logsource:
category: process_creation
product: linux
detection:
selection_download:
CommandLine|re: (wget|curl|tftp)\s+.*\.(arm[0-9]?|mips|mipsel|mpsl|x86|sh4|spc|arc|m68k)(\s|$)
selection_chain:
CommandLine|contains|all:
- chmod
- +x
selection_exec:
CommandLine|re: \./[A-Za-z0-9_.\-]+\s*$
condition: selection_download and (selection_chain or selection_exec)
falsepositives:
- Legitimate firmware update scripts on embedded/IoT devices that download and execute
vendor binaries
- CI/CD or provisioning tooling that fetches architecture-specific build artifacts
level: high
tags:
- attack.t1059.004
- attack.t1203
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33104
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free