Stealthy Masjesu Botnet Offers DDoS‑for‑Hire Service Targeting IoT Devices While Evading High‑Profile Networks
What Happened – A sophisticated botnet named Masjesu, active since 2023, provides a DDoS‑for‑hire service that compromises IoT routers, gateways and embedded systems. It spreads by exploiting known firmware flaws in devices from vendors such as D‑Link, Netgear and GPON, encrypts its payloads, and deliberately avoids high‑profile IP ranges (e.g., U.S. Department of Defense) to stay hidden.
Why It Matters for TPRM –
- The botnet can be rented to launch multi‑gigabit attacks against CDNs, gaming platforms and enterprise services, creating service‑disruption risk for downstream customers.
- Its focus on stealth and persistence means compromised IoT assets may remain undetected for months, increasing the attack surface of any organization that relies on third‑party IoT infrastructure.
- Operators advertise via Telegram, indicating a commercial “crime‑as‑a‑service” model that can be quickly adopted by threat actors targeting supply‑chain partners.
Who Is Affected – Technology & SaaS providers, manufacturing firms, energy & utilities, retail/e‑commerce operators, and any organization that deploys or manages IoT routers, gateways or embedded devices.
Recommended Actions –
- Conduct an inventory of all IoT assets and verify firmware versions against vendor advisories.
- Enforce strict network segmentation and egress filtering to block outbound traffic to known Masjesu C2 domains and ports (e.g., TCP 55988).
- Require vendors to demonstrate timely patching of known router vulnerabilities (CVE‑2024‑xxxx series).
- Monitor threat‑intel feeds for Masjesu‑related Telegram channels and implement user‑education on social‑media phishing.
Technical Notes – Masjesu uses multi‑stage XOR encryption to hide strings and C2 information, installs persistence via renamed system libraries and cron jobs, and launches TCP/UDP/HTTP flood attacks up to ~290 Gbps. Exploited vulnerabilities include outdated firmware on D‑Link, Netgear and GPON devices. Source: SecurityAffairs