ctrlINT What the industry said about every indicator, with the quote

BashliteMalware

  • Gafgyt
  • gayfgt
  • lizkebab
  • torlus

Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.From MISP Galaxy

Last reported 10 days ago, by Cyble4 reports

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1110Brute Force

    “Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.”

    CybleVendor
  2. T1014Rootkit

    “… successfully logging in, the threat actors downloaded and executed ShellBot using wget or curl, and subsequently installed a user-mode rootkit, XHide, and XMRig through a downloader.”

    AhnLab ASECVendor
  3. T1505.003Web Shell

    “Across nearly every category, whether it be Web Shells, Reverse Shells, or Proof of Execution, you'll find an unmistakable spike between 150-400 bytes.”

    GreyNoiseVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

4 reports, newest first · the exact sentence from each

  1. “CRIL also observed Hajime, Gafgyt, and Wacatac activity.”

    CybleVendor
    The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws

  2. “BruteForceAttack CoinMiner DDoS DictionaryAttack Downloader Fisieredoor Gafgyt Honeypot 통계 launcher Linux Mirai P2PInfect Preload Prometei Rootkit XHide XMRig”

    AhnLab ASECVendor
    Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026

  3. “Adjacent IP addresses in the same /24 as the scanner (87.121.84.25 and 87.121.84.45) are currently serving Mirai and Gafgyt variants targeting MIPS and ARM architectures, along with exploit scripts for consumer routers and DVRs.”

    GreyNoiseVendor
    React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic

  4. “The logic mapping specific architectures (like mipsel to mpsl) and the reliance on busybox wget are direct fingerprints of the Mirai/Gafgyt botnet families, which have been circulating for over a decade.”

    GreyNoiseVendor
    There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks

Indicators in its reports

named in the reports above
Copy these 19 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Bashlite here?
No account needed. We do not store your IP address.