New Masjesu Botnet Targets Routers and IoT Systems Globally

Cybersecurity researchers have exposed a stealthy botnet called Masjesu that has been operating as a DDoS-for-hire service since it first surfaced in 2023.

The botnet is marketed on Telegram and targets a wide range of IoT devices including routers and gateways across multiple hardware architectures.

The most recent iteration tracked by Trellix shows Masjesu now markets the ability to carry out volumetric DDoS attacks against content delivery networks, game servers and enterprises.

Attacks mounted by the botnet primarily originate from Vietnam, Ukraine, Iran, Brazil, Kenya and India, with Vietnam accounting for nearly 50% of the observed traffic.

One notable addition to its list of targets is Realtek routers, which it scans on port 52869, a port associated with the Realtek SDK’s miniigd daemon.