Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment

An exposed open directory on a command and control server revealed a complete deployment of the BYOB (Build Your Own Botnet) framework. The multi-stage infection chain targets Windows, Linux, and macOS platforms, implementing seven persistence mechanisms. The malware includes extensive post-exploitation capabilities such as keylogging, packet capture, and email harvesting. Analysis uncovered a modular design with encrypted C2 communications and infrastructure reuse across multiple regions. Two nodes also hosted XMRig cryptocurrency miners, indicating additional monetization efforts. The campaign has been operational for approximately 10 months, demonstrating geographic and provider diversification in its infrastructure.

• Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026Malware2026-10-14
• CVE-2026-105133: Ahsay AhsayCBS · Vulnerability Was DetectedMediumVulnerability2026-10-04
• Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own FilesMalware2026-09-08
• XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic SmokescreensMalware2026-07-30
• Plex vulnerabilities being exploited in the wild to drop a cryptominerMalware2026-10-19