TheMoon
- First seen
- 2014-01-01 00:00:00
- Malware type
- worm, botnet
- Family
- Malware family
- Profile updated
- 2026-07-07 14:30:36
Targeted industries: technology-and-telecommunications
Context
TheMoon is a self-replicating malware primarily targeting Internet of Things (IoT) devices, such as routers. It is known for creating a botnet used for various malicious activities, predominantly targeting the technology and telecommunications sector by exploiting vulnerabilities in routers.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Elf.Themoon (report)
- sans.org — Analyzing Backdoor Bot Mips Platform 35902 (report)
- ic3.gov — Psa250507 (report)
- justice.gov — Botnet Dismantled International Operation Russian And Kazakhstani Administrators (report)
- blog.lumen.com — The Darkside Of Themoon (report)
- s3.documentcloud.org — Anyproxy And 5Socks Indictment (report)
- ic3.gov — 250507 (report)
- fortinet.com — Themoon A P2P Botnet Targeting Home Routers (report)
- blog.lumen.com — A New Phase Of Themoon (report)