EnemyBot Puts Enterprises in the Crosshairs With Raft of 1-Day Bugs

EnemyBot DDoS botnet is rapidly weaponizing security bugs disclosed in CMS systems like WordPress plug-ins, Android devices, commercial Web servers, and other enterprise applications.

An Internet of Things (IoT) botnet dubbed “EnemyBot is expanding its front lines to target security vulnerabilities in enterprise services — potentially leading to it being a much more virulent threat than it has been, researchers say.
EnemyBot, which is controlled by a threat actor known as Keksec, is a Linux botnet that
emerged on the malware scene
in late March. It shares source code with two other well-known botnets, Gafgyt (aka Bashlite) and the
mighty Mirai
, according to a prior
analysis from Fortinet
. Like those threats, EnemyBot is used to carry out distributed denial-of-service (DDoS) attacks. Other aspects of the code include smaller elements from Qbot and other malware, and some custom development.
While it began life focusing on adding IoT devices and routers to its botnet footprint, EnemyBot has now evolved to add remote code execution (RCE) exploits for a host of popular business applications, including VMware Workspace ONE, Adobe ColdFusion, WordPress sites (via vulnerable plug-ins like Video Synchro PDF), PHP Scriptcase, and others, according to researchers at AT&T Labs.
Researchers discovered that the group is using a mix of recent, so-called one-day bugs, as well as older known issues, looking to take advantage in lags in patching.
Keksec is now targeting IoT devices, web servers, Android devices and content management system (CMS) servers, according to the firms
recent report
, which notes that the latest version of EnemyBot adds a webscan function containing a total of 24 exploits to attack vulnerabilities of different devices and Web servers and self-propagate.
The enterprise-focused exploits that were recently added include:
Log4Shell
vulns:
CVE-2021-44228
,
CVE-2021-45046
F5 BIG IP
devices:
CVE-2022-1388
Spring Cloud Gateway:
CVE-2022-22947
TOTOLink A3000RU wireless router:
CVE-2022-25075
Kramer VIAWare:
CVE-2021-35064
PHP Scriptcase: No CVE yet assigned
Adobe ColdFusion 11: No CVE yet assigned
The nature of devices and systems targeted through EnemyBot is different than vulnerabilities aimed at corporate datacenters, Bud Broomhead, CEO at Viakoo, tells Dark Reading. WordPress installations, Android devices, IoT devices and other targets for EnemyBot are all widely deployed (therefore might be hard to find), are operated by organizations of all sizes, and are often managed by lines of business that lack cybersecurity skills.
In addition to the DDoS capabilities, EnemyBot can also receive commands to download and execute new code that could add to its functions or update its vulnerability list, according to the analysis. This means that, worryingly, the malware can adopt new vulnerabilities within days of those issues being discovered, researchers warned, as seen when it added a bug tracked as CVE-2022-22954 affecting VMware Workspace ONE, almost immediately after disclosure.
Sean Malone, CISO at Demandbase, says that given its rapid development, EnemyBot and others like it present a new urgency for enterprise defenders.
The rapid weaponization of newly released vulnerabilities highlights the need to be able to patch almost instantaneously when new vulnerabilities are identified, he tells Dark Reading. We should assume that every piece of software, every application development framework, and every IoT device will have a critical vulnerability identified at some point. Our architectures should be designed to limit the available attack surface, and mitigate the blast radius of a compromised system through defense-in-depth measures.
That should include adding the ability to profile systems and network traffic to know what normal looks like, and alert when the system activity and network traffic deviates from that baseline, he adds.
This botnet emphasizes the need for rapid patching of internet facing devices and the risks of running apps in the cloud, says John Bambenek, principal threat hunter at Netenrich. This traffic is easily spotted on the wire, but in typical cloud deployments, organizations aren’t able to run network intrusion detection. If organizations aren’t running NIDS or rapidly patching, they are both blind and vulnerable.
For its part, Keksec is a well-resourced group that has been around since 2016, making a name for itself by creating various botnets-for-hire. Its
known for exploiting vulnerabilities
to invade multiple architectures with polymorphic tools (these can include Linux and Windows payloads, as well as custom Python malware), in order to accomplish everything from DDoS to cryptomining to espionage.
For instance, last year the operators made headlines with the Simps botnet, which was built for DDoS attacks on gaming targets. Another of its creations is the HybridMQ-keksec botnet, a Frankenstein-like effort created by combining and modifying the source code of Mirai and
Gafgyt
, just like EnemyBot.
Keksec is constantly adding to its arsenal, and has the ability to update and add new capabilities to its arsenal of malware on a daily basis, the AT&T Labs researchers note. And indeed, with the new ability to compromise enterprise services and devices, EnemyBot could be poised to ramp up the volume of its attacks.
In addition, the malware base source code can now be found online on GitHub, making it widely accessible, according to AT&T Labs, whose researchers also note that this wont be the only new EnemyBot variant to bubble up from Keksecs laboratory. The developer of the GitHub page on EnemyBot self-describes as a full time malware dev, that is also available for contract work.
That spells swelling attack volumes, researchers warn.
Being available through GitHub means that many types of threat actors, from professional cybercriminals to amateurs, will be able to adapt EnemyBot into new and multiple variants, says Broomhead. Without question, this is a red-lights-flashing warning sign for organizations to improve their discovery, threat assessment, and remediation capabilities.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
EnemyBot Puts Enterprises in the Crosshairs With Raft of 1-Day Bugs