HOMETHREATSMozi
APT / THREAT GROUP

Mozi

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Mozi is a IoT botnet, that makes use of P2P for communication and reuses source code of other well-known malware families, including Gafgyt, Mirai, and IoT Reaper.

Threat Analysis

Mozi is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Mozi

Patch Tuesday, May 2026 Edition
Krebs on Security· May 12, 2026
Claude Mythos Finds 271 Firefox Vulnerabilities
SecurityWeek· Apr 22, 2026
Mozilla Used Anthropic’s Mythos to Find and Fix 271 Bugs in Firefox
Wired Security· Apr 21, 2026
Firefox now has a free built-in VPN with 50GB monthly data limit
BleepingComputer· Mar 24, 2026
Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model
The Hacker News· Mar 7, 2026

External References

→https://blog.centurylink.com/new-mozi-malware-family-quietly-amasses-iot-bots/
→https://blog.netlab.360.com/mozi-another-botnet-using-dht/
→https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/
→https://blog.netlab.360.com/the-mostly-dead-mozi-and-its-lingering-bots/
→https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Mozielf.mozi

External Intelligence

Malpedia: elf.mozi

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Mozi