Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
A misconfigured open directory on IP address 86.53.111[.]212:8080 exposed critical details of an active cybercrime operation, including Moobot botnet source code, denial of service tools with attack records, and a fraudulent Chinese identity verification service. The exposed directory also contained StresD Pro+, a multi-user DDoS panel with 16 registered accounts and 32 recorded attacks on the collection date. The recovered Moobot source code revealed a previously unknown dormant download-and-execute functionality that represents the most plausible mechanism behind APT28's repurposing of Moobot for deploying malware to compromised devices. Despite a 2024 court-authorized disruption by the U.S. Department of Justice, Moobot remains active as of August 2026, with one active C2 server observed conducting over 500 short-duration attacks throughout the month, consistent with DDoS-as-a-service operations.
Indicators of Compromise
- ip: 162.141.92.192
- ip: 112.21.241.27
- ip: 39.175.139.108
- ip: 86.53.111.212
- domain: api.cemg.xyz
Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
Description
A misconfigured open directory on IP address 86.53.111[.]212:8080 exposed critical details of an active cybercrime operation, including Moobot botnet source code, denial of service tools with attack records, and a fraudulent Chinese identity verification service. The exposed directory also contained StresD Pro+, a multi-user DDoS panel with 16 registered accounts and 32 recorded attacks on the collection date. The recovered Moobot source code revealed a previously unknown dormant download-and-execute functionality that represents the most plausible mechanism behind APT28's repurposing of Moobot for deploying malware to compromised devices. Despite a 2024 court-authorized disruption by the U.S. Department of Justice, Moobot remains active as of August 2026, with one active C2 server observed conducting over 500 short-duration attacks throughout the month, consistent with DDoS-as-a-service operations.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://censys.com/blog/open-directory-exposes-moobot-source-code-and-activity/"]
- Adversary
- APT28
- Pulse Id
- 6a90f19bbcdbb55af3412789
- Threat Score
- null
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip162.141.92.192 | — | |
ip112.21.241.27 | — | |
ip39.175.139.108 | — | |
ip86.53.111.212 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainapi.cemg.xyz | — |
Threat ID: 6a914c4eacd9273b49a4e3ea
Added to database: 08/28/2026, 08:52:30 UTC
Last updated: 08/28/2026, 16:03:22 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.