Netgear and D-Link: Masjesu Botnet Targets Routers and Gateways For Paid DDoS Attacks

Masjesu Botnet: A Stealthy, Evolving IoT Threat for DDoS-as-a-Service

The Masjesu botnet, first detected in early 2023 and still active through 2026, has established itself as a highly sophisticated DDoS-for-hire service targeting Internet of Things (IoT) devices. Unlike traditional botnets that rely on large-scale, noisy infections, Masjesu prioritizes stealth and long-term persistence, avoiding high-profile networks like U.S. Department of Defense systems to evade detection and legal action.

Stealth Tactics & Operational Methods

Masjesu employs advanced evasion techniques to bypass security measures, including:

• XOR-based encryption to conceal command-and-control (C2) domains and payloads, decrypting them only at runtime.
• Hardened persistence by binding to a hardcoded TCP port and ignoring termination signals.
• Process masquerading, renaming its executable to mimic legitimate system files (e.g., a Linux dynamic linker) and using cron jobs to re-execute every 15 minutes.

Exploitation & Propagation

The botnet spreads by scanning random IP addresses for vulnerable open ports, targeting devices from manufacturers like D-Link, Netgear, Huawei, and GPON. Upon exploitation, it deploys a malicious shell script to recruit devices into its network. Once integrated, bots receive instructions to launch DDoS attacks under a unique "masjesu" user-agent.

Defensive Measures & Impact

Due to its obfuscation-heavy approach, traditional antivirus detection is often ineffective. Organizations are advised to:

• Monitor outbound traffic for unusual HTTP requests or connections to known malicious domains.
• Implement process and file integrity monitoring to detect spoofed system files or unauthorized cron jobs.
• Enforce basic IoT security hygiene, including changing default credentials and applying firmware updates to patch known vulnerabilities.

Masjesu’s commercial DDoS-for-hire model and low-profile operations make it a persistent threat, underscoring the need for behavior-based defenses in IoT security.

Source: https://cyberpress.org/masjesu-botnet-targets-routers/

D-Link cybersecurity rating report: https://www.rankiteo.com/company/dlink-corp

NETGEAR cybersecurity rating report: https://www.rankiteo.com/company/netgear

"id": "DLINET1775644215",
"linkid": "dlink-corp, netgear",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'customers_affected': 'Users of vulnerable IoT devices',
                        'industry': 'Technology, Consumer Electronics',
                        'type': 'IoT device manufacturers'}],
 'attack_vector': 'Exploitation of vulnerable IoT devices via open ports',
 'data_breach': {'data_encryption': 'XOR-based encryption for C2 domains and '
                                    'payloads'},
 'date_detected': '2023-01-01',
 'description': 'The Masjesu botnet, first detected in early 2023 and still '
                'active through 2026, is a highly sophisticated DDoS-for-hire '
                'service targeting Internet of Things (IoT) devices. It '
                'prioritizes stealth and long-term persistence, avoiding '
                'high-profile networks to evade detection and legal action. '
                'The botnet employs advanced evasion techniques, including '
                'XOR-based encryption, hardened persistence, and process '
                'masquerading to bypass security measures. It spreads by '
                'scanning for vulnerable IoT devices from manufacturers like '
                'D-Link, Netgear, Huawei, and GPON, deploying malicious shell '
                'scripts to recruit devices into its network. Once integrated, '
                "bots launch DDoS attacks under a unique 'masjesu' user-agent.",
 'impact': {'operational_impact': 'Disruption of services due to DDoS attacks',
            'systems_affected': 'IoT devices (D-Link, Netgear, Huawei, GPON)'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Traditional antivirus detection is often ineffective '
                    'against stealthy botnets like Masjesu. Organizations '
                    'should adopt behavior-based defenses and enforce IoT '
                    'security hygiene.',
 'motivation': 'Financial gain (DDoS-as-a-service)',
 'post_incident_analysis': {'corrective_actions': 'Adoption of behavior-based '
                                                  'defenses and enforcement of '
                                                  'IoT security hygiene',
                            'root_causes': 'Exploitation of unpatched firmware '
                                           'and default credentials in IoT '
                                           'devices'},
 'recommendations': ['Monitor outbound traffic for unusual HTTP requests or '
                     'connections to known malicious domains.',
                     'Implement process and file integrity monitoring to '
                     'detect spoofed system files or unauthorized cron jobs.',
                     'Enforce basic IoT security hygiene, including changing '
                     'default credentials and applying firmware updates.'],
 'response': {'containment_measures': 'Monitor outbound traffic for unusual '
                                      'HTTP requests or connections to '
                                      'malicious domains',
              'enhanced_monitoring': 'Behavior-based defenses for IoT security',
              'remediation_measures': 'Implement process and file integrity '
                                      'monitoring, enforce IoT security '
                                      'hygiene (change default credentials, '
                                      'apply firmware updates)'},
 'title': 'Masjesu Botnet: A Stealthy, Evolving IoT Threat for '
          'DDoS-as-a-Service',
 'type': 'DDoS-for-hire',
 'vulnerability_exploited': 'Unpatched firmware and default credentials in IoT '
                            'devices'}