{"id":54432,"date":"2023-11-03T18:41:00","date_gmt":"2023-11-03T18:41:00","guid":{"rendered":"https:\/\/www.darkreading.com\/ics-ot\/somebody-just-killed-mozi-botnet"},"modified":"2023-11-03T18:41:00","modified_gmt":"2023-11-03T18:41:00","slug":"somebody-just-killed-the-mozi-botnet","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/","title":{"rendered":"Somebody Just Killed the Mozi Botnet"},"content":{"rendered":"<p>The Mozi botnet is now a shell of its former self, thanks to a de facto kill switch triggered in August.<\/p>\n<p>Active since September 2019, <a href=\"https:\/\/www.darkreading.com\/iot\/new-malware-family-assembles-iot-botnet\" target=\"_blank\" rel=\"noopener\">Mozi is a peer-to-peer (P2P) botnet<\/a> that enables distributed denial-of-service (DDoS) attacks, as well as data exfiltration and payload execution. It infects Internet of Things (IoT) devices \u2014 <a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/microsoft-provides-steps-for-protecting-network-gateways-from-mozi-iot-botnet\" target=\"_blank\" rel=\"noopener\">using network gateways, for example<\/a>, as an inroad for more powerful compromises \u2014 and its source code has roots in other IoT-based botnets, including Mirai, Gafgyt, and IoT Reaper.<\/p>\n<p>Once the most prolific botnet in the world, Mozi has now all but shut down. In <a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/who-killed-mozi-finally-putting-the-iot-zombie-botnet-in-its-grave\/?&amp;web_view=true\" target=\"_blank\" rel=\"noopener\">a blog post published Nov. 1<\/a>, researchers from ESET speculated that the creators, or possibly the Chinese government, were responsible for distributing an update which killed its ability to connect to the outside world, leaving only a small fraction of working bots standing.<\/p>\n<p>&#8220;The new kill switch update is just a &#8216;stripped down&#8217; version of the original Mozi,&#8221; explains Ivan&nbsp;Be\u0161ina, senior malware researcher for ESET. &#8220;It has the same persistence mechanism, and it sets up the firewall in the same way as Mozi, but it lacks all of its networking capabilities,&#8221; rendering it null to future use.<\/p>\n<h2 class=\"regular-text\">Mozi&#8217;s Disappearing Act<\/h2>\n<p>Even in its earliest days, Mozi was a force to be reckoned with. <a href=\"https:\/\/securityintelligence.com\/posts\/botnet-attack-mozi-mozied-into-town\/\" target=\"_blank\" rel=\"noopener\">According to IBM&#8217;s X-Force<\/a>, from late 2019 through mid-2020, it accounted for 90% of global botnet traffic, causing a massive spike in botnet traffic overall. As recently as 2023, ESET tracked over 200,000 unique Mozi bots, though there could have been many more.<\/p>\n<p>Now it&#8217;s gone, even more quickly than it came.<\/p>\n<p>On Aug. 8, instances of Mozi within the country of India fell off a cliff. On Aug. 16, the same thing occurred in China. Now the botnet all but doesn&#8217;t exist in either country, and global instances are down to a small fraction of what they once were.<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4\" alt=\"Mozi configs globally, in India, and in China\"><figcaption>Source: ESET<\/figcaption><\/figure>\n<p>On Sept. 27, researchers from ESET discovered the cause: a configuration file inside a user datagram protocol (UDP) message, sent to Mozi bots, with instructions to download and install an update.<\/p>\n<p>The update was, in effect, a kill switch.<\/p>\n<p>It replaced the malware with a copy of itself, and triggered a few other actions on host devices: disabling certain services, access to certain ports, and executing certain configuration commands, and establishing the same foothold on the device as the malware file it replaced.<\/p>\n<p>Overlaps with its original source code, and private keys used to sign the kill switch, certainly indicated that those responsible were the original authors, but researchers also speculated whether the authors might have been coerced into killing their creation by Chinese law enforcement, <a href=\"https:\/\/therecord.media\/mozi-botnet-authors-arrested-in-china\" target=\"_blank\" rel=\"noopener\">which arrested them in 2021<\/a>.<\/p>\n<h2 class=\"regular-text\">Is This the End of Mozi?<\/h2>\n<p>Despite its huge presence around the world, to Be\u0161ina, Mozi wasn&#8217;t much of a threat to begin with.<\/p>\n<p>&#8220;One of the problems with Mozi was that it generated substantial amounts of Internet traffic as the bots were actively attacking devices all around the world, trying to spread on their own (without operators&#8217; supervision). It clutters security logs and creates petty incidents for security analysts monitoring infrastructure. Anyone with basic security countermeasures was safe,&#8221; he says.<\/p>\n<p>And ironically, thanks to its kill switch, Mozi has now made its host devices even more resilient to future malware infections than they otherwise would&#8217;ve been.<\/p>\n<p>As Be\u0161ina explains, &#8220;it hardens the device from further infection from other malware as it turns off management services like SSH server, and puts in place strict firewall rules. In this case, the persistence helps to keep this hardened configuration even after the reboot of the device, so the kill switch authors did the maximum they could to avoid reinfection with the original Mozi or another malware.&#8221;<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/ics-ot\/somebody-just-killed-mozi-botnet\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The once great botnet was nearly entirely eliminated in August. Why, who did it, and what comes next remain unclear.Read More <a href=\"https:\/\/www.darkreading.com\/ics-ot\/somebody-just-killed-mozi-botnet\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-54432","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Somebody Just Killed the Mozi Botnet 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Somebody Just Killed the Mozi Botnet 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-03T18:41:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Somebody Just Killed the Mozi Botnet\",\"datePublished\":\"2023-11-03T18:41:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/\"},\"wordCount\":627,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/lh7-us.googleusercontent.com\\\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/\",\"name\":\"Somebody Just Killed the Mozi Botnet 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/lh7-us.googleusercontent.com\\\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4\",\"datePublished\":\"2023-11-03T18:41:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#primaryimage\",\"url\":\"https:\\\/\\\/lh7-us.googleusercontent.com\\\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4\",\"contentUrl\":\"https:\\\/\\\/lh7-us.googleusercontent.com\\\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/somebody-just-killed-the-mozi-botnet\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Somebody Just Killed the Mozi Botnet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Somebody Just Killed the Mozi Botnet 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/","og_locale":"en_US","og_type":"article","og_title":"Somebody Just Killed the Mozi Botnet 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-11-03T18:41:00+00:00","og_image":[{"url":"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Somebody Just Killed the Mozi Botnet","datePublished":"2023-11-03T18:41:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/"},"wordCount":627,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/","url":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/","name":"Somebody Just Killed the Mozi Botnet 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4","datePublished":"2023-11-03T18:41:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#primaryimage","url":"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4","contentUrl":"https:\/\/lh7-us.googleusercontent.com\/TJ30eA4oczNxtgDA3DoGaGmWh279dYZvtAWMELulvprIJaWjWlj3Kb1CvmeLzEi4lsm5EgB6tHli_bGu5SRwmfAicwGr2mRruPX8dOovrru5NI0gDup-qkKmEFdHzpBpWuGxnGvKnzu1A0SdisSmUf4"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/somebody-just-killed-the-mozi-botnet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Somebody Just Killed the Mozi Botnet"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=54432"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54432\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=54432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=54432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=54432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}