Executive Summary
Since March 2026, a new IoT botnet campaign identified as ENIBot (also known as HuntBot) has been observed actively expanding its footprint across the internet. The malware functions as an autonomous worm, prioritizing cloud and hosting provider IP ranges for its propagation efforts. The botnet leverages thousands of unique IPs globally to execute coordinated Layer 7 distributed denial-of-service (DDoS) attacks including HTTP floods and Slowloris.
Technically, the botnet targets devices with exposed Android Debug Bridge (ADB) ports and Telnet services, using a weighted scanning distribution to identify new targets. It employs obfuscated shell commands and base64-encoded scripts for initial execution, subsequently downloading its main payload to /tmp/sshd. The operation is managed through a command-and-control (C2) infrastructure that provides real-time attack instructions and system updates to the infected nodes.
The campaign's rapid expansion, particularly in Europe and the Americas, represents a significant threat to web service availability. The integration of worm-like propagation with sophisticated DDoS methods like RUDY and Slowloris allows the threat actor to exhaust target resources with relatively low detection overhead. Organizations with IoT infrastructure or cloud-hosted services should ensure default credentials are changed and management ports are restricted.