Cybersecurity experts have revealed details about a hidden botnet used for DDoS attacks.

Known as Masjesu, this botnet has been advertised on Telegram as a DDoS-for-hire service since 2023. It can infect various IoT devices, like routers and gateways, with different architectures.

“Masjesu is designed to be persistent and hard to detect, favoring a careful and subtle approach instead of widespread infection. It deliberately avoids IP ranges owned by organizations like the Department of Defense (DoD) to ensure it lasts longer,” said Mohideen Abdul Khader F, a Trellix security researcher, in a report released on Tuesday.

The commercial service is also called XorBot because it uses XOR encryption to hide strings, configurations, and payload data. It was first reported by Chinese security company NSFOCUS in December 2023, who linked it to an operator named “synmaestro.”

A later version of the botnet, observed a year later, had added 12 command injection and code execution exploits to target routers, cameras, DVRs, and NVRs from various brands, including D-Link, Eir, GPON, Huawei, Intelbras, MVPower, NETGEAR, TP-Link, and Vacron, to gain initial access. New modules for launching DDoS attacks were also added.

“As a new botnet family, XorBot is growing rapidly, constantly infecting and controlling new IoT devices,” NSFOCUS said in November 2024. “These controllers are increasingly using social media platforms like Telegram to recruit and promote their services, attracting potential ‘customers’ through active promotions, which helps the botnet expand and develop.”

Trellix’s latest findings show that Masjesu advertises its ability to perform large-scale DDoS attacks, emphasizing its diverse botnet infrastructure and suitability for targeting CDNs, game servers, and enterprises. The attacks mainly come from Vietnam, Ukraine, Iran, Brazil, Kenya, and India, with Vietnam generating almost 50% of the observed traffic.

After being deployed on a compromised device, the malware creates and binds a socket with a specific TCP port (55988) to allow the attacker to connect directly. If this fails, the attack is immediately stopped.

Otherwise, the malware sets up persistence, ignores signals to terminate, stops commonly used processes like wget and curl (possibly to disrupt competing botnets), and connects to an external server to receive DDoS attack commands, which it then executes against its targets.

Masjesu can also self-propagate by scanning random IP addresses for open ports and adding successfully compromised devices to its infrastructure. A notable new target is Realtek routers, which it exploits by scanning for port 52869 – a port associated with the Realtek SDK’s miniigd daemon. Other DDoS botnets, like JenX and Satori, have used similar methods in the past.

“The botnet continues to grow by infecting a wide range of IoT devices from various manufacturers,” Trellix said. “Masjesu seems to avoid targeting sensitive organizations that could attract significant legal or law-enforcement attention, a strategy that likely improves its long-term survival.”