Morte Botnet Unveiled: A Rapidly Growing Loader-as-a-Service Campaign Exploiting Routers and Enterprise Apps

Researchers at CloudSEK Threat Intelligence (TRIAD) have exposed a Loader-as-a-Service campaign, Morte Botnet, that systematically compromises SOHO routers, IoT devices and enterprise applications through web-based command injection. According to CloudSEK, the operation has been active for at least six months and shows signs of rapid growth, with a 230% attack spike from July–August 2025 deploying multi-architecture malware including Morte binaries and cryptomining payloads.

The campaign hinges on command injection via unsanitised POST parameters such as ntp, syslog, and hostname, with attackers injecting shell commands to force devices to run wget or curl | sh. Key techniques include exploiting default credentials (admin:admin), targeting firmware upgrade and diagnostics endpoints, and using BusyBox tools for multi-platform payload delivery, while rotating infrastructure across dozens of IPs to evade takedowns.

After compromise, devices run staged deliveries with small shell scripts as droppers and native binaries like morte.x86 and morte.x86_64 for persistence, enabling cryptomining and HTTP-based C2 polling for command and control. The operation spans both consumer and enterprise ecosystems, including Oracle WebLogic, WordPress and vBulletin servers, and profiles like wlwps.htm and login[.]shtml.