Nexcorium Busybox Shell Check

Elgonad .@elgonad

•updated Apr 27, 2026•2•0•218

Detects execution of shell commands interacting with busybox (e.g., 'cat /bin/busybox'). This behavior is used by the Nexcorium Mirai variant to verify shell functionality after a successful Telnet brute-force attack.