TF-MAL-elf.zerobot
📛 Threat Title
Malware family: ZeroBot
Description
ThreatFox malware family `elf.zerobot`. Printable name: ZeroBot. Aliases: ZeroStresser.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.zerobot
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.zerobot
IOC database
- Type
- domain
- Value
elf.zerobot- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.zerobot
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.zerobot
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.rankiteo.com
Zerobot Botnet Exploits Tenda and n8n Vulnerabilities in Ongoing Campaign Akamai's Security Incident Response Team (SIRT) has uncovered an active botnet campaign, Zerobot , leveraging recently disclosed vulnerabilities in Tenda AC1206 routers and the n8n workflow automation platform. First detected in mid-January 2026, the malware linked to the Mirai botnet
-
web:bulwarkblack.com
Akamai SIRT discovers Zerobot botnet actively exploiting CVE-2025-68613 in n8n workflow automation platform, marking a shift from traditional IoT targeting to enterprise infrastructure.
-
web:cyberpress.org
Akamai's Security Incident Response Team (SIRT) has discovered an ongoing botnet campaign dubbed Zerobot that exploits recently disclosed vulnerabilities in Tenda AC1206 routers and n8n workflow automation platforms. This malware campaign, linked to the Mirai botnet family , was first identified in mid-January 2026 and targets a wide range of vulnerabilities to infect devices and execute ...
-
web:cybersecuritynews.com
A Mirai-based botnet campaign known as Zerobot has resurfaced with renewed force, this time targeting critical flaws in Tenda AC1206 routers and the n8n workflow automation platform. The campaign, now operating on its ninth known iteration — dubbed zerobotv9 — has been actively exploiting recently disclosed command injection vulnerabilities to spread malware across exposed networks and ...
-
web:gbhackers.com
An active Zerobot campaign abusing two critical vulnerabilities CVE-2025-7544 in Tenda AC1206 routers and CVE-2025-68613 in the n8n workflow automation platform.
-
web:netcrook.com
Fast Facts Zerobot is a new botnet campaign linked to the infamous Mirai malware family . It exploits two major vulnerabilities: one in Tenda AC1206 routers (CVE-2025-7544), and another in the n8n automation platform (CVE-2025-68613). The campaign was first detected in January 2026 by Akamai's Security Incident Response Team.
-
web:securityonline.info
According to a recent investigation by the Akamai Security Intelligence and Response Team (SIRT), a notorious malware family known as Zerobot has re-emerged with new tricks. This latest iteration, dubbed "Zerobotv9," is not just going after standard home internet equipment; it is actively attacking enterprise-level workflow automation systems.
-
web:www.akamai.com
The Akamai SIRT discovered an ongoing Mirai-based malware campaign, dubbed Zerobot , targeting a variety of recent CVEs, including those affecting Tenda AC1206 routers and the n8n workflow automation platform. The botnet campaign dates back to at least early December 2025, with the recent exploits being identified in our global network of honeypots in mid-January 2026 to spread a Mirai malware ...
-
web:www.fortinet.com
NOTE: The term " Zerobot " in this article refers to a specific malware variant. It is not in any way associated with zerobot .ai, an organization that offers a verbal chatbot service. In November, FortiGuard Labs observed a unique botnet written in the Go language being distributed through IoT vulnerabilities. This botnet, known as Zerobot , contains several modules, including self-replication ...
-
web:www.threatintelreport.com
Zerobot represents an evolution of Mirai botnet tooling that opportunistically exploits recently disclosed vulnerabilities rather than relying on zero-days. The campaign began with simpler netcat and socat techniques in December 2025 before shifting to wget and curl-based downloaders in January 2026.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.