Same Malware, New Servers: Investigating Mozi's October 2026 Propagation Network

On October 15, 2026, two web addresses were recorded handing out Mozi, a peer-to-peer worm that has lived in routers and other small Linux devices since 2019. One address offered a build for ARM processors. The other offered a build for MIPS. At 09:34 UTC the next morning, neither address accepted a connection.

The files are old. The machines that hand them out are a rotating set of devices, and an address recorded one afternoon is a poor thing to treat as infrastructure the next day.

The hosts did not answer

URLhaus, the abuse.ch catalogue of malware URLs, recorded three fetches on October 15:

• At 03:02 UTC, 60.214.231.246 on port 46912, path /i, returned the MIPS file.
• At 14:06 UTC, the same host and port, path /bin.sh, returned that same MIPS file.
• At 14:11 UTC, 113.53.69.165 on port 46289, path /bin.sh, returned the ARM file.

The catalogue marked both addresses online, and described them as having served malware only briefly. A catalogue row is a snapshot. It does not say the device is still reachable, or still compromised, the next day.

We requested those two hosts, on both paths, at 09:34 UTC on October 16. The requests used a short timeout and a size cap. Nothing came back, so there was nothing to hash and nothing to run. 113.53.69.165 port 46289 failed to connect in 3.6 seconds, on /bin.sh and on /i. 60.214.231.246 port 46912 produced no answer within 21 seconds, on either path. The connection died before any HTTP response, so the path never came into it. We did not scan other ports, and we did not talk to any other address.

A failed connection from one network is a single observation. It shows that those URLs were not a reliable place to collect the file about nineteen hours after the last recorded fetch. It does not prove the devices left the internet.

A fresh URLhaus lookup that morning stopped at the site's browser check, and the API rejected a query with no key. The October 15 times above are the published catalogue records. The file identities below come from Triage reports of those exact hashes, and from Indicaweb's measurements of the same hashes through September.

The binaries are years old

A SHA-256 names one file. These two hashes have been in public sandboxes for a long time, under a pile of different submission names.

The ARM file is 307,960 bytes:

12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef

Triage sample 210112-jfqx11711x, from 12 January 2021, is that hash, submitted as Mozi.m. The same hash and the same MD5, eec5c6c219535fba3a0492ea8118b397, come back on 25 April 2022 as Mozi.aakzznwuh (220425-2dxcrsbdbq), on 24 September 2025 under the filename i (250924-ts5npazxct), on 15 August 2026 (260815-phk43swzcz), and on 8 October 2026 (261008-wykltab14v). The bytes recorded in October 2026 are the bytes from January 2021.

The MIPS file is 135,784 bytes:

4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7

Triage has it on 10 September 2025 (250910-w7lkgahp7s), on 5 January 2026 (260105-phfjla1kam), and on 3 August 2026 with the filename i (260803-gxg2zacq5y). It is a big-endian MIPS binary, packed with UPX, with the packer fields zeroed so the ordinary unpacker refuses it. That packing habit is older than this file.

Indicaweb watched the same two hashes, and four others, from 24 March through 28 September 2026. Fabio Russo's update on 28 September says the five binaries from March were still the ones being served, with no rebuild in between. In the last week of that window, 146 hosts served the ARM hash and 143 served this MIPS hash. A sixth MIPS file, first seen on 1 April, is a smaller and separate binary. Hashes that differ by a single extra byte were counted as broken transfers of these same files.

The October addresses are new places to pick up old bytes.

One file, two family names

The ARM hash is also filed as Mirai. Triage's 8 October 2026 report of that exact file applies both "Family: Mirai" and "Family: Mozi", and it carries the lines "Mirai ARM payload" and "Detects Mozi Payload". The report title is mirai. Triage's 15 August 2026 report of the same hash is filed as Mozi and does not carry the Mirai family line. A catalogue row from October 5 already attached a Mirai label to this same hash at another host. URLhaus would not show that row again on October 16 without a passed browser check, so the two Triage reports are the pages we re-read.

The hash is one file. The detectors disagree about the family name, including with themselves across two reports of the same bytes.

That disagreement has a history. 360 Netlab named Mozi in 2019 from filenames such as Mozi.m and Mozi.a, which is the name on the January 2021 Triage submission, and wrote that the worm reused code from Mirai, Gafgyt, and IoT Reaper. A signature aimed at Mirai's scanner, its watchdog change, or its attack traffic will match a Mozi binary that still contains those pieces. Trend Micro's write-up of Backdoor.Linux.MOZI.A notes that other engines still call the same family Mirai. The label moves. The SHA-256 does not.

The server is another device

Mozi does not need a rented download server. A device that is already running the worm opens a high port and serves the next copy over plain HTTP. Indicaweb's honeypot, a single sensor in Helsinki, saw the long-standing path /i on that port, often with a Server: nginx header and a content type that claimed the download was a zip archive. The October records add /bin.sh beside it. On the MIPS host, both paths returned one hash. A second path is another name for the same offer.

The same six-month log separates the machine that scans from the machine that serves the file. From 30 August to 27 September, 98.6 percent of download attempts were told to fetch the binary from a different address than the one that had just logged in. The other 1.4 percent pointed back at the scanner. From one sensor that split has two ordinary explanations: a device behind a shared address, or a bot handing out some other bot's address. Either way, blocking the address that probed you leaves the address that delivers the file untouched.

The command channel is a separate fact. The crawler walked 1,465,137 DHT nodes between 29 March and 28 September and intercepted zero commands. Indicaweb's conclusion is that the command network is gone, not merely quiet. Chinese law enforcement arrested operators in September 2021. In August 2023 a kill switch, documented by ESET, went out through that DHT and told bots that were online and participating to stop spreading and to take down their own download service. Bots that were offline, unreachable, or unable to write the change never got it. The 2026 ARM sample still contains the old command parser. Nothing in the measured DHT was feeding it.

The two October hosts have the shape of devices on access networks, which is short of proof that either one was infected, and short of proof that one person ran both.

113.53.69.165 is announced by AS23974. The registration name on that announcement is Thailand's Ministry of Education, the organization field came back as TOT, and a city-level estimate places it in the Bangkok area. 60.214.231.246 is announced by AS4837, China Unicom's China169 backbone, with a city-level estimate of Jinan in Shandong. We looked those up on 16 October 2026 through a public IP-to-network service. An announcement is who routes the address, not who owns the box, and a city is an estimate. It is a campus or a provincial broadband range, the kind of network a router sits on. It is a weak match for a hosting company rented as a campaign server.

Indicaweb's longer count points the same way, with MaxMind GeoLite2 for the countries. Of 2,227 attacking addresses over 183 days, about half were in Pakistan and about a third in China. Of 3,981 serving hosts, about 79 percent were in China. Scanners and servers are different populations. Shared hashes, high ports, and the paths /i and /bin.sh are what this worm does when it copies itself. They do not identify an operator.

Addresses rotate, and the file stays

Over those six months Indicaweb recorded 4,275 address-and-port pairs serving the binary. About 59 percent appeared on a single day. None of the 15 nodes from the March write-up were seen after 16 August 2026, and 14 of them were gone by 21 April. In the week of 21 to 28 September, 289 nodes served the file, and 51 of those were still up on the 28th. The report is explicit that these are infected devices, not a standing server farm.

The October 16 connection attempts sit on that curve. They are one pair of observations, not a new measurement of the turnover rate. The two hosts from October 15 did not complete a handshake the next morning. A blocklist of yesterday's addresses is stale by the time it is published. The stable indicators are the hashes, the processor family, and the first and last time an address was seen.

The volume numbers need the same reading. Daily download totals in that research are reliable for the most recent thirty days only, because an earlier maintenance job truncated the older ones. From 30 August to 27 September the sensor counted 1,931,206 download attempts. The median day was 54,600. The first week's median was 39,667, and the last week's was 110,820. Distinct attacking devices stayed flat, at a median of 41 a day, and flat across the whole six months at an average of 38. More tries from the same number of devices is a change in effort. Indicaweb does not treat it as growth, and a single honeypot is not the size of the network.

What a running copy still does

The sandbox reports agree on the behavior of these two files.

A device that runs one of them scans outward, tries weak remote logins and old bugs in exposed management services, and then offers the binary to the next device. The 2022 ARM run contacted about twenty thousand remote hosts. The October 2026 ARM run contacted about seventeen thousand. Both read the routing table and the process list, write a startup script, and change the watchdog so a reboot is less likely to clear the process. The MIPS runs show the same persistence and the same discovery. Historical reporting also credits the family with denial-of-service traffic. The public vulnerability lists are years old. This piece stays with the behavior.

Two 2021 capabilities do not show up in the copies Indicaweb took apart this year. Microsoft's August 2021 research described device-specific startup changes for Netgear, Huawei, and ZTE gateways, and a traffic-hijack path that spoofed DNS and altered web sessions. The 2026 samples did not exhibit that. The arrests and the kill switch did not erase the copies already sitting on devices that missed the order. Those copies kept scanning.

A 2024 campaign, Androxgh0st, was reported to reuse pieces of Mozi's spreading code. That is a different program. It does not pull these October URLs into that campaign.

Derp's Mozi page lists further hashes analysed in the first half of October 2026, including two dated 16 October. A family tag on a newer file is a different claim from a matching SHA-256. The two URLs in this piece served the old hashes.

What the October records establish

They establish a continuing propagation loop. An ARM binary that has been byte-for-byte the same since at least January 2021, and a MIPS binary that has been the same since at least September 2025, were still being offered on 15 October 2026, from high ports on networks that look like someone else's router. The next morning those two offers were gone, which is the pattern Indicaweb measured across thousands of earlier nodes: the file stays, the server does not.

They do not establish a new operator, a rebuilt October variant of these two files, or a single campaign behind every host that has ever served them.

If you run a router, a camera, or a recorder that is reachable from the internet, the consequence is the practical one. Install the vendor's updates, or replace the device when the vendor has stopped shipping them. Close Telnet and the management page to the open internet. Replace the password the device shipped with. Requesting the URLs in this piece, on purpose, is how the worm is delivered.