APT33’s Shamoon Botnet Leaked, Exposing 15-Node Relay Network

Key Takeaways

• An Iran-linked threat actor’s entire botnet infrastructure, including a 15-node relay network, was exposed due to an unsecured staging server.
• The leak provided unprecedented insight into the group’s operations, revealing SSH mass deployment tools, DDoS capabilities, and a command-and-control (C2) bot client.
• The actor employs on-host compilation of malware to evade traditional hash-based detections.
• Evidence suggests the botnet infrastructure was also used to run a commercial VPN relay service.

Iran-Linked Botnet Infrastructure Exposed After Server Misconfiguration

The complete operational infrastructure of a botnet attributed to an Iran-linked threat actor has been inadvertently exposed, providing cybersecurity researchers a rare look into a live, active cybercriminal operation. The significant leak occurred when the actor left an open directory on their staging server, revealing critical components of their attack framework.

This exposure brought to light a 15-node relay network, a sophisticated SSH deployment system designed for mass infections, distributed denial-of-service (DDoS) tools compiled directly on victim machines, and a bot client with a hardcoded command-and-control (C2) address that appears to be under active development.

Discovery and Infrastructure Details

The exposure came to light on February 24, 2026, during routine scanning operations. A server located at IP address 185.221.239[.]162, hosted on infrastructure registered to Dade Samane Fanava Company (PJS), an Iranian internet service provider, was flagged as having an open directory.

The compromised server contained 449 files distributed across 59 subdirectories. These files included crucial operational elements such as a tunnel configuration, Python-based deployment scripts, pre-compiled DDoS binaries, C-language source code for denial-of-service attacks, and a list of credentials used to target victim systems via SSH.

Analysts at Hunt.io identified the exposed server while conducting a routine review of Iranian-hosted infrastructure. Their proprietary AttackCapture™ feature, which indexes open directories across the internet, facilitated the discovery.

Further investigation, by pivoting on a shared Let’s Encrypt TLS certificate linked to the wildcard domain *.server21[.]org, uncovered an additional 14 IP addresses exhibiting the same digital fingerprint. Seven of these were hosted on Hetzner Online GmbH in Finland, with the remaining seven registered to Iranian ISPs, including Dade Samane Fanava Company (PJS) and Sindad Network Technology PJSC. The domain itself was registered in 2023, with its DNS routing through ArvanCloud (arvancdn[.]ir), an Iranian content delivery network provider.

The exposed infrastructure served a dual purpose. A configuration file, named config-client.yaml, detailed a KCP-based packet tunnel utilizing Paqet—an open-source tool designed to circumvent Iran’s national internet filtering system. This setup allowed the Iranian server to forward encrypted traffic to a Hetzner exit node in Finland. The presence of 3x-ui, a web-based proxy panel offering user account management and traffic quotas, further suggested that a commercially operated VPN relay service was running concurrently with the attack infrastructure.

A recovered bash history file meticulously documented the operator’s workflow across three distinct phases: tunnel deployment, DDoS tooling development, and botnet construction. Inline code comments written in Farsi, along with raw Arabic-script characters resulting from keyboard input errors, strongly indicate an Iran-based actor.

The bash history also revealed specific DDoS targets, including a FiveM GTA server at 5.42.223[.]60 on port 30120, and two HTTP/HTTPS-facing hosts. The actor employed custom C-language tools—syn.c, flood.c, and au.c—alongside MHDDOS, which was cloned from GitHub and compiled directly on the staging host.

SSH-Driven Mass Deployment

The primary infection vector for this botnet relies on a Python script named ohhhh.py. This script is designed to parse credentials formatted as host:port|username|password and establish up to 500 concurrent SSH sessions with victim machines. Once an SSH session is active, the bot client source file, cnc.c, is retrieved from the staging server, compiled on the victim machine using gcc -pthread, and then launched in a detached screen session. This on-host compilation strategy is a deliberate tactic to bypass binary detection, as no pre-built executable is ever transferred, rendering standard hash-based scanning largely ineffective. The compiled binary is then renamed “hex” on infected hosts, a generic name chosen to avoid raising suspicions during routine system checks.

The bot client, which identifies itself as “BOT CLIENT v1.0,” registers each newly infected host by sending a beacon containing the victim’s IP address, hostname, and process ID, reporting it as “UnknownBOT ONLINE.” The binary incorporates built-in reconnection logic, ensuring that infected machines will persistently attempt to reach the C2 server even if the staging server temporarily goes offline. A secondary script, yse.py, functions as a kill switch, enabling the operator to remotely terminate all active sessions by executing pkill -9 screen across every compromised host.

What You Should Do

• Immediately block all identified IP addresses associated with this operation across your network infrastructure.
• Monitor for and flag specific filenames and SHA-256 hashes linked to ohhhh.py, yse.py, and the cnc binary.
• Harden SSH access by enforcing key-based authentication, disabling root login, and restricting concurrent sessions to prevent credential-driven attacks.
• Implement monitoring for unexpected gcc compilation activity on production servers, as on-host binary building is a strong indicator of advanced persistent threats designed to evade standard binary-level detections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.