Excerpt
"Ancient": a Linux IoT botnet with a custom ANCT C2 protocol
KSI Digital threat research | first published 2026-10-05
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a public write-up of this family, its markers, or its ANCT protocol tag. Several feeds currently tag its binaries as generic "Mirai", but its C2 protocol is not Mirai's.
All indicators are in iocs.csv . The three dropper versi…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by GitHub on github.com.
Mentioned in the excerpt
More from GitHub49
- How-to-use-msfvenomGitHub · Added 19 Oct
- GitHub - FallenAstaroth/stink: the cutest python-native infostealerGitHub · Added 18 Oct
- cti/runster/readme.md at main · cert-orangecyberdefense/ctiGitHub · Added 16 Oct
On the same topics
- Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware FamilySilent Push · Published 4 Feb
- Kazuar: Anatomy of a nation-state botnetMicrosoft · Published 14 May
- Emotet Botnet Disrupted in International Cyber OperationUS Department of Justice · Published 28 Jan 2021
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
