Two new malware strains hijack linux boxes for botnets and crypto loot
Network gear you forgot to patch is now a cash machine for crooks. Eclypsium’s labs caught CondiBot and Monaco in the wild on 6 March, both previously unseen, both built to turn routers, NAS boxes and IoT junk into either a DDoS cannon or a quiet crypto miner.
The pair signals a shift: state-sponsored groups still matter, but plain cyber-gangs now treat firmware like an ATM. No fancy zero-days, just default passwords and recycled Mirai code, repackaged for profit.
Condibot resurrects mirai with a restart kill-switch
Written in C, CondiBot spreads through generic Linux binaries that try every downloader trick in the book—wget, curl, tftp—until one lands. Once inside, it neuters the device’s ability to reboot, phones home to a command-and-control server, and waits for orders to flood targets with junk traffic. The binary doesn’t bother checking for rival bots; it simply overwrites them, a territorial move that keeps the bandwidth exclusively for its masters.
Eclypsium traced active samples targeting Fortinet gear, but the malware carries a broad Linux-bot agent, meaning any ARM or MIPS box with a public IP is fair game. The payload is light—under 300 KB—yet it persists by hooking rc scripts deep in the firmware, a place most IT inventories never reach.
Monaco brute-forces ssh, then mines monero on your dime
Monaco, coded in Google’s Go, skips the DDoS theatrics and goes straight for the wallet. It fires off SSH login attempts at random public addresses on port 22, cycling through a laughably short dictionary: admin, ubuntu, root, 123456. When a guess hits, it downloads an x86 or ARM miner, kills competing mining processes, and wires the Monero to a wallet hosted on Alibaba Cloud’s Singapore region (IP 8.222.206.6). Strings in the binary suggest Chinese-speaking developers, but attribution remains murky; cloud regions are cheap and disposable.
The miner itself is configured to throttle CPU usage just enough to avoid tripping monitoring alarms—an old ops trick that still works because most edge devices have no baseline for "normal" load.
Network devices become the new beachhead
Google’s TAG team warned last month that initial access is sliding downhill from employee laptops to the routers and VPN appliances that sit unloved in wiring closets. Once inside, lateral movement is trivial: these gadgets often share management VLANs with servers that hold the real crown jewels.
The timing is no accident. FIFA’s World Cup, the U.S. mid-terms and the generative-AI boom have all inflated DDoS ransom demands. A 100 Gbit/s botnet built from discarded security appliances can rent for $3,000 an hour on dark-web marketplaces, making even a 5,000-device swarm a six-figure revenue stream before anyone notices.
Patching firmware is tedious; the business case is now nakedly obvious. If your switch still ships with SSH open to the internet and a password equal to its model name, CondiBot and Monaco are already knocking.