MALWARE FAMILY

Mozi

Internal ID: elf.mozi

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Mozi is a IoT botnet, that makes use of P2P for communication and reuses source code of other well-known malware families, including Gafgyt, Mirai, and IoT Reaper.

Threat Analysis

Mozi is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.centurylink.com/new-mozi-malware-family-quietly-amasses-iot-bots/

→https://blog.netlab.360.com/mozi-another-botnet-using-dht/

→https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/

→https://blog.netlab.360.com/the-mostly-dead-mozi-and-its-lingering-bots/

→https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/

→https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf

→https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave

→https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/

→https://www.elastic.co/blog/collecting-and-operationalizing-threat-data-from-the-mozi-botnet

→https://www.microsoft.com/security/blog/2021/08/19/how-to-proactively-defend-against-mozi-iot-botnet/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.mozi

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Mozi