Do Son 
At a Glance
| Malware Family | Doorway botnet (modular Rust scanning and delivery engine with staged loaders) |
| Threat Actor | Unattributed operator group known internally as “the team” (suspected commercial proxy network builder) |
| Target / Victims | Routers, IP cameras, digital video recorders, optical network terminals, and enterprise Java servers (4,217 logged IPs and 1,772 mapped victim devices across 75+ territories) |
| Delivery Vector | Multi-protocol automated exploitation via 59 run modules, default credential attacks, and brute-force spraying |
| Key Capabilities | IP-bound HMAC payload delivery, credential learning feedback loops, MikroTik SOCKS proxy creation, and automated AI-driven task management |
TL;DR
In October 2026, CloudSEK researchers uncovered two open directories exposing 41 gigabytes of operational data from the Doorway botnet. The Rust Doorway botnet compromises thousands of network devices to build an unauthorized residential proxy fleet. Furthermore, the operators breached enterprise developer servers and internet service provider routers across more than 75 countries.
Delivery and Attribution
CloudSEK discovered the operation after finding two exposed staging mirrors at 16.5.0.225 and 16.5.0.226. Both servers shared byte-identical files and belonged to an identical six-address source IP pool on scan host X99-2. The server archives contained 53,407 files across 9,370 folders, revealing the complete operational data of the campaign. Between September 19 and October 19, 2026, the crew scanned target networks using six rotating source IP addresses. This rotation helped the attackers bypass automated connection limits.
Confirmed technical attribution links the entire infrastructure to a single developer collective that refers to itself as the team. In internal playbooks, the actors assign specialized roles named keeper, scout, and watcher to manage daily operations. However, suspected attribution to a specific nation or cybercrime syndicate remains unconfirmed. Instead, the evidence suggests a financially motivated group building an unauthorized proxy network for resale. According to the CloudSEK research report, the group deployed a dedicated toolset that pairs rapid scanning with multi-stage software delivery.
Infection Chain
The core scanning engine contains roughly 21,870 lines of custom Rust code. It includes 59 exploitation modules targeting routers, cameras, and enterprise applications. Every connection begins with a strict HTTP request bearing the hardcoded header User-Agent: Hello World. Next, the scanner evaluates server banners against strict signature rules before attempting exploitation. If a target matches too many general banners, the scanner drops the connection as a honeypot.
Tiered Payload Delivery and Verification
When a vulnerable host responds, the Rust Doorway botnet initiates a five-stage attack sequence. The process follows a strict chain: probe, credential leak, login, validate, and clean. First, the engine runs a read-only probe to verify the software version without altering device settings. Once verified, the scanner deploys an entry command to download an architecture-specific loader.
The system supports multiple transport protocols to bypass firewall rules. For instance, the engine cycles through netcat, wget, curl, TFTP, FTP, NFS shares, and formatted printf commands. As the report explains, “Every injection sink fires every chain in order.” To protect its infrastructure, the server appends a 16-character hexadecimal signature to every download link. This signature binds the file download to the exact target IP address. Consequently, security researchers cannot download the payload using an external internet address.
After delivery, the loader sends an ICMP echo request back to an attacker receiver at 45.205.1.9. This ping signals successful code execution before the malware downloads the next stage. Next, the loader fetches a MIPS, ARM, or x86 client matching the target CPU. For example, on compromised Openfire messaging servers, the loader drops a Java plugin named ofvalid.jar. This plugin checks the operating system and downloads the secondary client.
Command-and-Control and Data-Exfiltration Behaviour
In addition to consumer hardware, the Doorway botnet targets enterprise servers and telecommunications equipment. Operational records confirmed 20 Jenkins servers compromised through remote code execution. Furthermore, the operators uploaded malicious plugins to 16 internet-facing Openfire servers and breached 29 DARKLANTERN router interfaces. Across all modules, the scanner database logged 4,671 device join records across 4,217 distinct IP addresses.
MikroTik SOCKS Proxy Fleet and ISP Data
The primary objective of the campaign centers on network proxy creation. The database documented 7,369 successful authentications against 4,923 unique MikroTik RouterOS devices. Once logged in, the scripts configure internal SOCKS proxy services on each router. This allows the operators to route unauthorized web traffic through compromised residential and commercial internet connections. Moreover, the group extracted 1,060 PPPoE subscriber records from a single internet service provider. In internal ledgers, the operators claimed 3.8 million scanned addresses and logged 11,363 device joins in one hour.
The Watcher Management Model
The most remarkable discovery in the open directories was an operational playbook titled WATCHER-BRIEF.md. As the authors wrote, “This is the CONTEXT the watcher carries. It is not a dumb cron.” The team runs its botnet like an enterprise site reliability engineering group. Specifically, automated watcher scripts use commercial artificial intelligence models through OpenRouter to supervise five distinct operational tasks.
The watcher evaluates network production every cycle by tracking active downloads and device connections. When a target family stops producing new bots for 30 minutes, the watcher alerts team chat. It then redirects resources to more productive vectors such as ActiveMQ or Tomcat servers. Meanwhile, the credential engine stores authentication outcomes in line-indexed files. It tracks 34 default passwords and ranks successful credentials based on real-world device compatibility.
Defense and Detection Guidance
Security teams can identify scanning activity by monitoring web logs for the User-Agent: Hello World string. Network defenders should also watch for unusual ICMP echo requests directed toward 45.205.1.9. In addition, firewall administrators should restrict access to management interfaces on routers, cameras, and enterprise servers. Organizations must never expose Openfire, Jenkins, or ActiveMQ administration ports directly to the public internet.
Administrators managing MikroTik routers should audit active services for unauthorized SOCKS proxy configurations. They must also disable default administrative accounts and enforce strong, unique passwords across all network hardware. Furthermore, telecommunications providers must review access logs for abnormal PPPoE configuration exports. Finally, organizations should isolate connected devices on segmented networks to block lateral movement during an intrusion.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
