Skip to content
Country Currency EN

Without a choice of your own we suggest country and currency from your IP address (not stored). Your choice stays in your browser only. Converted amounts are approximations; the original amount is always shown.

News

Security incident

CloudSEK exposes Doorway botnet: compromised routers and cameras built into a proxy fleet

CloudSEK found two open directories with about 41 GB of operational data from the Doorway botnet. The operators scanned for and exploited routers, IP cameras and enterprise Java servers to build an unauthorised proxy fleet.

CloudSEK researchers have published an analysis of the "Doorway" botnet, a modular Rust scanning and delivery engine that compromises internet-connected devices and turns them into a proxy network. According to CloudSEK, two exposed staging servers held about 41 GB of operational data, including source code, a credential database, victim logs and operator playbooks.

What the data shows

  • The scan ran from 19 September to 19 October 2026, according to the recovered files. The operation was still active when CloudSEK analysed it.
  • The botnet exploited routers, IP cameras, optical network terminals and enterprise Java servers through 59 exploit modules and default-credential attacks.
  • CloudSEK confirmed 7,369 successful MikroTik/RouterOS logins across 4,923 devices. On the compromised routers, the scripts configure SOCKS proxy services, which route third-party traffic through the victims' internet connections.
  • The recovered material includes 1,060 PPPoE subscriber records from a single internet service provider.
  • The operators' own ledgers report larger totals, such as 11,363 device joins in one hour. CloudSEK labels these self-reported and not independently verified.

Attribution

CloudSEK links the infrastructure to one group that calls itself "the team". It has not attributed the group to a state or a specific criminal syndicate. The evidence suggests a financially motivated operator that builds a proxy network for resale, but CloudSEK says the commercial monetisation is not confirmed.

Relevance for proxy buyers

Residential and ISP proxies can come from consumer devices that were compromised without their owners' knowledge. The same risk appeared in the GreyNoise report on Pawns.app residential proxies (see the earlier article on that story). Buyers should ask providers how they source their exit IPs. CloudSEK recommends blocking the listed command-and-control and beacon addresses and auditing routers for unauthorised SOCKS services.

Sources: CloudSEK, Doorway botnet analysis; SecurityOnline, Rust Doorway botnet exploits routers, cameras, and servers.

Sources