A botnet crew left the blueprints for its own operation sitting in the open. Researchers Lakshya Dubey and Ayush Juneja at CloudSEK found two identical open directories in October 2026 holding about 41 GB of operational data from a campaign they call Doorway: the full source code of its exploitation engine, a credential database and victim logs.
The haul shows a mature, metrics-driven operation that breaks into routers, surveillance cameras, optical network units (the boxes that terminate fibre connections) and enterprise Java services, then recruits them into a fleet that CloudSEK describes as a proxy-building operation. According to the original report, the operation was still active while the researchers were investigating it.
Thousands of devices, counted like a business
The operator's own ledger records 11,363 device joins and 58,920 second-stage payload downloads, figures CloudSEK ties to a scanning run between 19 September and 19 October 2026. The researchers' own count from the recovered records found:
- 4,671 module-level join records covering 4,217 distinct IP addresses
- 7,369 successful MikroTik RouterOS logins across 4,923 device identities
- 1,060 PPPoE subscriber records associated with a single internet provider
- 20 Jenkins servers with confirmed remote code execution and 16 Openfire plugin uploads
- 18 DARKLANTERN router compromises, eight confirmed through beacon evidence
CloudSEK stresses that these are minimum confirmed counts, because of errors during acquisition.
A Rust engine that looks before it strikes
The core tool, named doorway, is a Rust program of roughly 21,870 lines of first-party code with 59 exploit modules aimed at cameras, routers, ONUs and Java-based services. Every target starts with a single web request carrying a hard-coded "User-Agent: Hello World" header. It fingerprints the reply and runs a read-only probe before attempting exploitation.
A built-in credential store learns as it goes, ranking passwords by how many distinct devices they unlock, and ships with 34 default credential pairs. To land a payload, the engine fires every delivery chain it has, in order: netcat, wget, curl, TFTP, FTP, an NFS mount and, for devices with no download tool at all, a dropper that rebuilds the binary from a series of printf commands.
For MikroTik routers, the documented chain centres on CVE-2023-30799, also known as FOISted, and a small MIPS payload named stage2.so that beacons out over ICMP and then opens an interactive shell on TCP port 4444. The preserved field log for that branch records three attempts against RouterOS 6.48.6, all of which failed, so the tooling is confirmed but its success at scale is not.
A botnet managed like an operations team
The most unusual file in the haul is not code. A document named WATCHER-BRIEF.md sets out five concurrent sessions with standing objectives, production thresholds and automated replanning. When output drops, effort shifts to other target families, and three idle cycles in a row trigger a single high-priority escalation. CloudSEK reports that the sessions are tied to large language model tooling, citing OpenRouter and opencode keys found among the files.
Hunt for the Hello World scanner and lock down RouterOS
Defenders get unusually clean hooks here. CloudSEK maps the infrastructure to six scanning addresses, one payload file server, one NFS export and one primary beacon receiver, and points to the "Hello World" user agent, the ICMP beacons and exploit-specific traffic as detection opportunities. MikroTik owners should confirm RouterOS is current and that no admin account has an empty password, since the exploit script logs in as admin with a blank one. We have covered earlier attacks seizing MikroTik routers.
Indicators from CloudSEK's report
- Staging mirrors, part of the six-address scanning pool: 16[.]5[.]0[.]225, 16[.]5[.]0[.]226
- Beacon receiver: 45[.]205[.]1[.]9 (reverse shell on TCP/4444)
- Payload server: hxxp://45[.]90[.]13[.]169:8080/
- NFS export: 45[.]90[.]13[.]11:/srv/nfs
- Short delivery domains: fd6[.]eu (later recorded as NXDOMAIN), 19z[.]in
- ofvalid.jar (Openfire plugin loader) SHA-256: 1fc4d07f44b576cfa77092c143d432cb089ce10ed38ac7559e77ae6b4c85b509
The leak cuts both ways. It hands defenders a rare inside view of how an IoT botnet is built, tested and managed, and it shows a crew treating compromise as a production line, with ledgers, thresholds and escalation rules. That discipline is what turns a list of default passwords into a durable proxy network.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.