Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption

An open directory misconfiguration exposed the Moobot botnet's source code, operational denial of service tools, and a fraudulent identity verification service. Analysis of the source code uncovered a dormant download-and-execute functionality likely used by APT28 to repurpose Moobot for malware deployment. The exposed StresD Pro+ panel showed multi-user DDoS operations with multiple recorded attacks. Despite a 2024 disruption authorized by the U.S. Department of Justice, Moobot continues to operate with an active command and control server conducting over 500 short-duration attacks in August 2026, indicating ongoing DDoS-as-a-service activity.

The exposure of Moobot's source code and operational data enables adversaries to analyze, replicate, or enhance the botnet's capabilities, including its dormant malware deployment functionality. The continued activity of Moobot despite legal disruption efforts demonstrates resilience and ongoing threat to targeted networks through DDoS attacks. The presence of a fraudulent identity verification service and multi-user DDoS panel indicates organized cybercrime infrastructure supporting various malicious activities.

No official patch or remediation is applicable as this is an operational compromise of cybercrime infrastructure rather than a software vulnerability. Organizations should monitor for Moobot-related activity and apply defensive measures against DDoS attacks. Authorities managing the disruption of Moobot should be consulted for updates on ongoing mitigation efforts.