TI-2026-002 โ MikroTik Recon & Telegram Stealer Botnet
Coordinated IoT Botnet ยท 15 Nodes ยท 14 Countries ยท Residential Infrastructure
๐ Executive Summary
A precisely synchronized botnet of 15 compromised residential devices spanning
14 countries was caught executing an identical 9-step reconnaissance sequence
on our honeypot between March 21 and April 9, 2026. Every node logged in with
root:root, used the same libssh2 library, and ran the exact same
commands โ a textbook indicator of centralized command-and-control (C2) orchestration.
The attack sequence reveals a multi-purpose intelligence collection operation that simultaneously:
- ๐ Identifies MikroTik routers โ using RouterOS-specific
/ip cloud print - โ๏ธ Checks for existing cryptominers โ competitive displacement before deployment
- ๐ฑ Steals Telegram Desktop sessions โ hijacking
tdatafor account takeover - ๐ก Detects SMS/GSM gateway infrastructure โ identifying SIM farms for abuse
- ๐ท๏ธ Searches for a mystery marker โ
D877F783D5D3EF8Cs(infection tag)
7 of 10 tested nodes are confirmed MALICIOUS by GreyNoise. The IPs belong to residential ISPs (Korea Telecom, Rostelecom, Swisscom, Viettel, Windstream) โ indicating these are compromised home routers/IoT devices, not dedicated infrastructure.
๐ฏ The 9-Step Attack Sequence
Every single botnet node executes this exact sequence in under 90 seconds:
๐ฌ Step 7 โ Full Target List
The single most revealing command checks for 5 distinct asset types:
This reveals the botnet operator is specifically looking for: (a) Telegram accounts to hijack, (b) physical SIM farm hardware for SMS fraud/2FA bypass, and (c) Qualcomm cellular modem interfaces. This is hallmark SIM-swap and account takeover infrastructure.
๐ Global Botnet Map โ 15 Nodes, 14 Countries
| Node | IP Address | Country | ISP / ASN | Date Hit | GreyNoise |
|---|---|---|---|---|---|
| ๐ข 1 | 178.160.209.67 |
๐ฆ๐ฒ Armenia | Telecom Armenia ยท AS12297 | Mar 21 | โ |
| ๐ด 2 | 85.30.212.24 |
๐ท๐บ Russia | Rostelecom ยท AS42610 | Mar 23 | MALICIOUS |
| ๐ด 3 | 121.165.204.105 |
๐ฐ๐ท South Korea | Korea Telecom ยท AS4766 | Mar 24 | MALICIOUS |
| ๐ข 4 | 36.89.252.58 |
๐ฎ๐ฉ Indonesia | Telkom Indonesia ยท AS7713 | Mar 25 | โ |
| ๐ด 5 | 222.108.39.109 |
๐ฐ๐ท South Korea | Korea Telecom ยท AS4766 | Mar 28 | โ |
| ๐ด 6 | 5.187.97.40 |
๐ฌ๐ต Guadeloupe | Canal Telecom ยท AS21351 | Mar 31 | MALICIOUS |
| ๐ด 7 | 144.2.91.96 |
๐จ๐ญ Switzerland | Swisscom ยท AS3303 | Apr 1 | MALICIOUS |
| ๐ด 8 | 173.185.74.18 |
๐บ๐ธ USA | Windstream ยท AS7029 | Apr 4 | MALICIOUS |
| ๐ด 9 | 183.98.76.106 |
๐ฐ๐ท South Korea | Korea Telecom ยท AS4766 | Apr 5 | MALICIOUS |
| ๐ข 10 | 218.145.181.48 |
๐ฐ๐ท South Korea | Korea Telecom ยท AS4766 | Apr 6 | โ |
| ๐ด 11 | 173.185.74.18 |
๐บ๐ธ USA | Windstream ยท AS7029 | Apr 7 | MALICIOUS |
| ๐ข 12 | 81.18.37.142 |
๐ฐ๐ฟ Kazakhstan | Radiobaylanys ยท AS29046 | Apr 8 | โ |
| ๐ด 13 | 171.241.43.241 |
๐ป๐ณ Vietnam | Viettel ยท AS7552 | Apr 9 | MALICIOUS |
| ๐ข 14 | 87.249.188.12 |
๐ธ๐ช Sweden | Ljusnet ยท AS25417 | Apr 10 | โ |
| ๐ข 15 | 202.44.227.204 |
๐น๐ญ Thailand | Internet Thailand ยท AS4618 | Apr 11 | โ |
๐งฌ Behavioral Fingerprint
๐ Activity Timeline (Mar 21 โ Apr 11)
One new zombie IP hits the honeypot every 1-3 days โ steady C2 tasking rhythm:
๐ Mystery Marker: D877F783D5D3EF8Cs
Every node runs locate D877F783D5D3EF8Cs โ a search for a specific
file with a hexadecimal-like name. This pattern is consistent with:
- Infection marker โ a file dropped by prior malware to signal "already compromised"
- C2 beacon file โ presence indicates active C2 communication channel
- Competition check โ if file exists, another operator already controls this device
The marker was not found in VirusTotal, ThreatFox, or AlienVault OTX, suggesting it's either a custom botnet-specific artifact or recently deployed. Google shows some references โ likely from other honeypots catching the same botnet.
โ๏ธ Criminal Activities Assessment
| Activity | Evidence | Severity | Impact |
|---|---|---|---|
| ๐ Residential Device Compromise | 15 IPs across residential ISPs, all with root:root |
โ Critical | Homeowners unknowingly host malware |
| ๐ก MikroTik Router Hijacking | /ip cloud print โ RouterOS-specific command |
โ Critical | DNS hijacking, traffic interception, VPN tunneling |
| ๐ฑ Telegram Session Theft | Checks tdata directory for all users |
โ Critical | Account takeover, impersonation, crypto scams |
| ๐ SIM Farm Detection | Checks for GSM modems, SMS daemons, QMI interfaces | โ High | 2FA bypass, SMS fraud, SIM-swap attacks |
| โ๏ธ Cryptominer Preparation | ps | grep '[Mm]iner' โ checking for competitors |
โ High | Resource theft, electricity costs for victims |
| ๐ค Botnet Infrastructure | Identical commands across 15 IPs = centralized C2 | โ Critical | Platform for DDoS, spam, further attacks |
๐ฏ Why MikroTik Routers Are the Prize
๐บ๏ธ Geographic Distribution Analysis
ICS
(Industrial Control Systems) by Shodan โ potentially compromised critical infrastructure.
๐ก๏ธ Our Defense Response
/ip cloud print.๐ง Final Assessment
This is a professionally operated reconnaissance botnet with a sophisticated multi-layer target assessment strategy. The operator is not simply looking for machines to infect โ they are categorizing assets:
| If MikroTik router | โ Hijack for DNS poisoning, VPN tunnel, persistent proxy |
| If Telegram present | โ Steal session for account takeover, impersonation, crypto scams |
| If SIM farm/GSM modem | โ Abuse for 2FA bypass, SMS fraud, SIM-swap attacks |
| If computing power available | โ Deploy cryptominer (after removing competition) |
| If marker present | โ Skip โ already controlled by this or allied operator |
The 1-IP-per-day rotation suggests the C2 has a large pool of compromised devices and tasks each one against a batch of targets before moving to the next. Our honeypot is likely one of thousands of IPs being profiled. The South Korean cluster (4 IPs on Korea Telecom) may indicate a regional exploitation campaign targeting KT's residential router infrastructure.
๐ Investigation Metadata
| Investigation ID | TI-2026-002 |
| Date Conducted | 2026-04-18 |
| Data Sources | Cowrie honeypot logs, GreyNoise Community API, Shodan InternetDB, IPWhois, WHOIS, ThreatFox, AlienVault OTX |
| Analysis Tools | LSN SOC Dashboard, 25 MCP Tools, Python correlation scripts, botnet fingerprinting |
| Monitoring Period | 2026-03-21 โ 2026-04-11 (22 days) |
| Botnet Nodes | 15 confirmed (10 primary + 5 additional via command correlation) |
| GreyNoise Hits | 7/10 tested = MALICIOUS |
| Confidence Level | VERY HIGH โ identical command sequences across 15 IPs is definitive botnet evidence |