Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2

An Iranian threat actor's operational infrastructure was exposed through an open directory, revealing a 15-node relay network spanning Finland and Iran, an SSH-based botnet framework, and an active command and control server. The exposed bash history documented the full operation, including tunnel deployment, DDoS tooling development, and botnet creation. The actor used on-host compilation to evade detection and leveraged a Python script for mass SSH deployment. The botnet client, compiled and renamed 'hex' on infected hosts, showed automatic reconnection capabilities. This operation appears to be financially or personally motivated rather than state-directed, with infrastructure dual-purposed for censorship bypass and attack operations.

• Kairos Hold'em: Dissecting a New Go-Based DDoS BotnetMalware2026-10-30
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits EmergeBotnet2026-10-23
• 2026 Q3 Linux SSH Server Targeted Malware Statistics ReportMalware2026-10-14
• Anthropic warns self-replicating AI could spread to your smart devicesAnalysis2026-10-13
• The phone was compromised before the user turned it on: the rise of Midnight MimosaMalware2026-10-12