NEW MALWARE HIGHLIGHTS INCREASED SYSTEMATIC TARGETING OF NETWORK INFRASTRUCTURE

Summary from the TLDR InfoSec newsletter

Eclypsium captured two previously undocumented malware variants on March 6: CondiBot, a Mirai-derived multi-architecture DDoS botnet (arm, mips, x86) with 32 registered attack handlers, competitive botnet killing, and C2 beaconing via port 20480 (0x5000) to 65.222.202.53; and Monaco, a Go 1.24.0 SSH scanner and XMRig-based Monero cryptominer attributed to a likely Chinese-speaking actor hosted on Alibaba Cloud (8.222.206.6), brute-forcing ~3.6 billion IPs with 50+ hardcoded credentials and reporting stolen creds back over raw TCP. Both variants exploit the EDR/XDR visibility gap on network appliances by operating below the OS layer. Defenders should monitor for /tmp/monaco, unauthorized chmod 777 operations, unexpected XMRig processes, and apply YARA rules from Eclypsium's full report to detect CondiBot artifacts including the "QTXBOT" string identifier.