TF-1868464 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mozi. Confidence: 75. First seen: 2026-08-04 18:19:16 UTC. Reporter: HoneyLabs. Tags: elf, IoT, Mozi.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mozi. Confidence: 75. First seen: 2026-08-04 18:19:16 UTC. Reporter: HoneyLabs. Tags: elf, IoT, Mozi.

• Mozi Botnet: Evolving Threat to IoT Devices - hunt.io
  web:hunt.io

  Discover how the Mozi botnet exploits IoT vulnerabilities, its evolution, targeted sectors, and strategies to protect your devices from this persistent threat.

  2026-08-04 23:48 UTC
• Mozi (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Mozi is a IoT botnet, that makes use of P2P for communication and reuses source code of other well-known malware families, including Gafgyt, Mirai, and IoT Reaper.

  2026-08-04 23:48 UTC
• AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
  web:thehackernews.com

  The threat actors behind the AndroxGh0st malware are now exploiting a broader set of security flaws impacting various internet-facing applications, while also deploying the Mozi botnet malware . "This botnet utilizes remote code execution and credential-stealing methods to maintain persistent access ...

  2026-08-04 23:48 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-08-04 23:48 UTC
• URLhaus | Browse - abuse.ch
  web:urlhaus.abuse.ch

  Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.

  2026-08-04 23:48 UTC
• Cyber Swachhta Kendra: Mozi IoT Botnet - CSK
  web:www.csk.gov.in

  It has been reported that a new malware named Mozi is affecting IoT devices globally. Affected IoT devices are being assembled into an IoT botnet which could be employed by botnet owner for launching distributed denial-of-service (DDoS) attacks, data exfiltration and payload execution. According to the reports, Mozi malware is comprised of source code from Gafgyt, Mirai, and IoT Reaper ...

  2026-08-04 23:48 UTC
• Collecting and operationalizing threat data from the Mozi botnet - Elastic
  web:www.elastic.co

  The Mozi botnet is an ongoing malware campaign targeting unsecured and vulnerable networking devices. This post will showcase the analyst journey of collecting, analyzing, and operationalizing threat data from the Mozi botnet.

  2026-08-04 23:48 UTC
• Mozi IoT Botnet Malware: Analysis, Detection, Removal | Huntress
  web:www.huntress.com

  Mozi is a nasty piece of work derived from the source code of other IoT malware families like Mirai, Gafgyt, and IoT Reaper. It primarily functions as a P2P botnet, meaning infected devices communicate directly with each other instead of a centralized command-and-control (C2) server.

  2026-08-04 23:48 UTC
• A new botnet attack just mozied into town - IBM
  web:www.ibm.com

  A relatively new player in the threat arena, the Mozi botnet, has spiked among Internet of things (IoT) devices, IBM X-Force has discovered. This malware has been active since late 2019 and has code overlap with Mirai and its variants. Mozi accounted for nearly 90% of the observed IoT network traffic from October 2019 through June 2020. This startling takeover was accompanied by a huge ...

  2026-08-04 23:48 UTC
• How to proactively defend against Mozi IoT botnet
  web:www.microsoft.com

  Mozi is a peer-to-peer (P2P) botnet that uses a BitTorrent-like network to infect IoT devices such as network gateways and digital video records (DVRs). It works by exploiting weak telnet passwords1 and nearly a dozen unpatched IoT vulnerabilities2 and it's been used to conduct distributed denial-of-service (DDoS) attacks, data exfiltration, and command or payload execution.

  2026-08-04 23:48 UTC

Only Available for Registered Users. Sign in to view.