TF-MAL-elf.themoon
📛 Threat Title
Malware family: TheMoon
Description
ThreatFox malware family `elf.themoon`. Printable name: TheMoon.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.themoon
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.themoon
IOC database
- Type
- domain
- Value
elf.themoon- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.themoon
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.themoon
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:advisory.eventussecurity.com
A recent investigation by researchers has unveiled a sophisticated, multi-year campaign targeting end-of-life small home/small office (SOHO) routers and IoT devices. This campaign revolves around an updated version of the notorious " TheMoon " malware . The malware , which had been relatively dormant, has resurfaced to power the growth of a cybercriminal-focused proxy service named Faceless ...
-
web:cinchops.com
Protecting Your Network: Remediation Steps The FBI has outlined several key recommendations to protect against TheMoon and similar threats: Replace end-of-life equipment: If your router has reached end-of-life status, the most effective solution is to replace it with a newer model that still receives security updates.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the TheMoon malware family including references, samples and yara signatures.
-
web:securityonline.info
A critical vulnerability in multiple Linksys E-Series routers is being actively exploited in the wild by a self-propagating malware campaign known as TheMoon worm, according to new research from the SANS Technology Institute. The flaw, tracked as CVE-2025-34037, carries a maximum CVSS score of 10.0, underscoring its severity.
-
web:sos-vo.org
A campaign involving an updated version of " TheMoon " malware has targeted End-of-Life (EoL) small business routers and Internet of Things (IoT) devices through a cybercriminal proxy service called "Faceless." Lumen Technologies' Black Lotus Labs team discovered that TheMoon malware , which first appeared in 2014, was working quietly while growing to over 40,000 bots from 88 countries by January ...
-
web:thecyberexpress.com
FBI warns of TheMoon malware exploiting End of Life routers. Learn how to protect against rising threats targeting outdated, vulnerable routers.
-
web:www.bleepingcomputer.com
A new variant of " TheMoon " malware botnet has been spotted infecting thousands of outdated small office and home office (SOHO) routers and IoT devices in 88 countries.
-
web:www.fbi.gov
Recently, some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware .
-
web:www.ic3.gov
End of life routers were breached by cyber actors using variants of TheMoon malware botnet. Recently, some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware . This malware allows cyber actors to install proxies on unsuspecting victim routers and conduct cyber crimes anonymously.
-
web:www.lumen.com
As our team has discovered, the majority of these bots are used as the foundation of a notorious, cybercriminal-focused proxy service, known as Faceless. While Lumen has previously documented this malware family , our latest tracking has shown TheMoon appears to enable Faceless' growth at of a rate of nearly 7,000 new users per week.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.