Executive Summary
- A misconfigured open directory on
86.53.111[.]212:8080exposed critical details of active cybercrime operator, including Moobot botnet source code, other denial of service (DOS) tools with attack records, and a fraudulent identity verification service – providing a rare view of a malicious operation in progress. - Also present on the host is “StresD Pro+”, a multi-user DDoS panel with 16 registered accounts and 32 recorded attacks on the day of collection. The panel operates independently from the Moobot, generating attack traffic directly from the staging host using a purpose-built Minecraft Bedrock Edition RakNet flooder.
- A service on the same host, branded as a 公安身份核验系统 (“public security identity verification system”), is a black-market identity fraud tool that resells access to a third-party Chinese PII lookup API, while collecting full identity documents from users through an embedded appeal flow.
- The recovered source for Moobot includes a previously unknown, but dormant download-and-execute functionality that represents the most plausible mechanism behind APT28’s reported repurposing of Moobot.
Introduction
An open web directory (86.53.111[.]212), exposed on 30 July 2026, held the source code for Moobot, a variant of the Mirai DDoS malware, alongside additional DDoS tools and a suspected fraudulent Chinese ID verification service. Based on recovered attack logs and ongoing monitoring, multiple recovered DoS toolkits were active in July 2026.
Moobot was first seen in 2019; in February 2024, it was the subject of a court-authorized disruption led by the U.S. Department of Justice. According to the U.S. Department of Justice, the Moobot botnet was run by cybercriminals and on at least one occasion was repurposed by APT28, attributed Unit 26165 of Russian intelligence service, for deploying malware to previously compromised devices. Based on identified infrastructure and C2 monitoring, Censys ARC assesses that Moobot remains active in August 2026.
The report provides a technical overview of Moobot and findings from an exposed open web directory, exposing active DDoS operations.
Moobot
Moobot was first discovered by Netlab 360 in 2019. A derivative of Mirai, the IoT botnet whose leaked source has seeded countless variants, it inherits Mirai’s core design: a bot that spreads across low-security network devices, reports to a central command-and-control (C2) server, and can launch various network traffic flood methods for conducting distributed denial-of-service (DDoS) attacks.
The code recovered from the open directory is unmistakably Moobot. Two signatures from prior research appear verbatim in the source. The first is the C2 registration magic 0x336699 packet header, which Netlab 360 recorded in Moobot’s earliest samples. The second is a 32-character seed, w5q6he3dbrsgmclkiu4to18npavj702f, used by the bot’s random-string generator; both Fortinet and Unit 42 cite this exact value as a Moobot identifier. A Chinese build tutorial included in the directory, is an indication that the source code for Moobot may be distributed among multiple parties.
C2 Protocol
Moobot communicates with infected systems using a variant of the custom protocol used by Mirai. Similar to a traditional IRC bot, in which a bot maintains a persistent connection with the C2 server, instead of a poll-based checkin, the following table shows the protocol flow:
Moobot’s supported commands match those from Mirai, but critically add new functionality for deploying additional payloads, previously not known before this source code disclosure. Two such routines are present in the recovered source; both are dormant, one commented out entirely and one defined but never called. When this command is issued, it will task infected systems to send an HTTP GET /<ARCH> request to a hardcoded IP address and then write as executable, rename, fork, and execute the returned ELF file.
Stresd-pro
Also present in the same open web directory as the Moobot source code is the operator’s DDoS management panel, branded StresD Pro+ in the frontend. The backend is Node.js/Express over WebSocket, with separate user (port TCP/33197) and admin (port TCP/33198) servers. At the time this data was recovered, 32 unique attacks from 6 different customers were recorded in log files.
Despite sharing the same host as the Moobot source, stresd-pro operates independently. When a user issues an attack, server.js spawns a local Python script (attack.py) which generates flood traffic directly from the local server rather than tasking the Moobot bot fleet – resulting in a Denial of Service attack (not a Distributed Denial of Service attack). attack.py is a purpose-built Minecraft Bedrock Edition server flooder, implementing the full RakNet handshake before flooding the target with malformed encapsulated packets and randomized NACK sequences.
Registering an account on the panel requires a license-key (卡密), which determines how long the account is active (day, week, month, year, permanent), concurrent-attack slot limits and a per-hour launch cap. When a key expires, the panel returns 卡密已过期，请续费 (“card code expired, please renew”), indicating the key system is designed around paid access. The source does not include a payment processor, so key distribution likely occurs out-of-band.
On 30 July 2026, 16 accounts were registered and active across all five tiers:
Permanent:
960137
Year Tier (1 account):
lIIllIlII(deliberately obfuscated using capital-I and lowercase-l)
Months Tier (2 accounts):
fanshaofangyuan
Weeks Tier (1 account):
xiaoyi
Days Tier (11 accounts):
smkjmjhYYDSDFYYDSDCqazwsxe1123456happygrayL19127qwerty16575456114514114514
Further analysis of this tooling reveals deliberate monitoring of the panel’s own users. When users issue an attack, the frontend will capture each customer’s client IP, user-agent, screen resolution, CPU core count, and browser fingerprint. An example of the details saved is shown below:
{ |
In addition to the user fingerprinting, the operator’s bash history reveals a series of iterative patches to server.js that could have exposed plaintext passwords for new registrations; however, these changes are not visible in the recovered source code.
Service history for the host of the open web directory (86.53.111[.]212) does not show either the user or admin port within Censys scans.
Prior services on ports TCP/80 and TCP/3000 do not appear related to this service, likely indicating this management panel was either not directly run on the system we collected from, firewalled off from scanners, or running behind a reverse proxy we have not identified.
Fake Government Verification Panel
Present on TCP/3000 of the same host as the exposed open directory (86.53.111[.]212:3000) was a Chinese government themed web service titled 公安身份核验系统 (“public security identity verification system”). The open web directory on TCP/8080 included the source code for this service under ./gov-verify. Functionally, the tool acts as a reseller wrapper around a third-party identity lookup API at api.cemg[.]xyz: when a user submits a Chinese citizen’s name and 18-digit national ID number, the panel validates the ID format locally, then makes a single call to https[:]//api.cemg[.]xyz/api/2ys.php?name=<name>&id=<idCard> and returns the result verbatim – 致 (“match”) or 假冒身份 (“fake identity”).
From boot.js (used to setup the portal) shows account linkages to stresd-pro. During installation, an admin account is created with username 960137, password 960137SL, and the 48-character admin key 9QL5U6ZXpSAdRYLTZcnbGaSwN6xMJnXM6HmrnHvwu15evcta — identical to the credentials hardcoded into stresd-pro. The deploy script references gov-verify-v6.zip, indicating an element of mature, iterated development.
Censys ARC Perspective
The open directory on 86.53.111[.]212 provided a rare level of visibility into a live operation. The recovered source tree, panel data, and shell history present a snapshot of an active operation as of late July 2026. Recovered attack logs show activity on the day of collection, with customers connecting from Chinese IP addresses and directing attacks at China Mobile ranges.
At the time of writing, Censys observes one active Moobot C2 server linked to this operation: 162.141.92[.]192, hosted on DeluxHost in Amsterdam (ASN 214677). Throughout August 2026, we have observed over 500 short-duration attack tasking from this C2 server (TCP/14123) against a variety of targets; behavior consistent with DDoS-as-a-service operations.
Examining the recovered source also sheds light on the access mechanism behind the reported APT28 use of Moobot. While the DOJ briefing does not characterize how APT28 came to repurpose Moobot, the dormant download-and-execute functionality present in this build represents the most plausible mechanism: with this functionality enabled – a C2 operator could issue the update command to deploy arbitrary payloads on already-compromised devices. Whether that access was obtained through exploitation of the C2 or through a commercial arrangement with the criminal operator remains an open question.
The current observed Moobot activity appears to be operated by a financially motivated actor with no assessed nexus to state-sponsored activity.
Censys Enterprise customers with the Adversary Infrastructure module can track Moobot and other named malware families in the Censys Platform.
Track Moobot in Censys
