New Botnet ‘Loader-as-a-Service’ Turns Home Routers and IoT into Mirai Farms

According to CloudSEK, a sophisticated Loader-as-a-Service botnet campaign has emerged over the last six months, orchestrating attacks against SOHO routers, embedded Linux devices, and enterprise applications by exploiting exposed command-and-control logs. The operators abuse unsanitised POST parameters such as NTP, syslog and hostname fields, alongside default credentials and known CVEs in WebLogic, WordPress and vBulletin to achieve remote code execution.

Between July and August 2025, attack volume surged by 230%, delivering multi-architecture malware including morte binaries and cryptomining payloads. The campaign’s exposed server logs reveal a methodical attack sequence with modules for login attempts, injection commands delivered via wget or busybox scripts, and post-exploit reconnaissance collecting MAC addresses, firmware versions and reachable services to tailor payloads.

Post-compromise, operators deploy JSON-RPC miners or Mirai-style bots to harness hijacked resources for cryptomining or further DDoS campaigns. CloudSEK continues monitoring and has alerted impacted customers whose tech stacks match the targeted vectors, emphasising the need for vigilant multi-layer defence and rapid remediation.