Diicot: Emerging Romanian Threat Actor

According to Cado researchers (now part of Darktrace), the Diicot campaign is an emerging Romanian threat actor activity centred on SSH brute-forcing and cryptojacking, with Diicot using custom tools, modified packers and Discord for C2 to expand into doxxing and DDoS attacks via a Mirai-based botnet named Cayosin.

The group has been active since at least 2020 and, in the latest campaign, employs a self-propagating SSH brute-forcing tool called aliases, with a chain that can deploy a Mirai-style Cayosin agent on OpenWrt routers and beyond. Investigations found that four Discord channels for this campaign were created within an 11-minute window on 26 April 2023, signalling likely automated channel creation, and that Cayosin enables DDoS activity as part of Diicot’s broader toolkit.

The campaign also demonstrates a shift toward mixed capabilities, including cryptojacking, credential theft, and targeted exploitation of internet-exposed SSH servers, with evidence of doxxing tied to Romanian-language payloads and images. Darktrace highlights that these tactics underscore Diicot’s willingness to deploy MaaS-style concepts and multiple attack vectors depending on targets encountered.