VULNpocalypse
MediumVulnerabilityActive

Doorway botnet: CloudSEK reports router, camera and Jenkins compromises

CloudSEK reports a Doorway botnet exploiting routers, cameras, Jenkins and Openfire. Remove default credentials and check logs for its indicators.

Published
Exploitation
Yes, according to CloudSEK, which reports recovered operator logs and beacon evidence; no independent verification

What happened

CloudSEK reports that it found an active IoT exploitation and proxy-building operation, which it calls “Doorway”. According to CloudSEK, the operation targets routers, surveillance cameras, optical network units (ONUs) and enterprise servers CloudSEK. These findings come from a single vendor research post. No other party has independently verified them.

CloudSEK says it found two identical exposed open directory workspaces in October 2026. It says they held about 41 GB of operational data, including:

  • The source code of “doorway”, a Rust-based scanning and delivery engine with about 21,870 lines of first-party code and 59 exploit modules.
  • A credential database.
  • Victim logs, beacon captures and operator playbooks.

The source is CloudSEK.

From these records, CloudSEK reports the following CloudSEK:

  • 4,671 module-level join records covering 4,217 distinct IP addresses.
  • 7,369 successful MikroTik/RouterOS authentications across 4,923 device identities.
  • 1,060 PPPoE subscriber records associated with a single ISP, which is not named.
  • 20 Jenkins remote code execution confirmations.
  • 16 Openfire plugin uploads.
  • 18 compromises it labels DARKLANTERN router compromises, eight of them confirmed through beacon evidence.

CloudSEK also says the operator’s own internal ledger reports 11,363 joins and 58,920 second-stage fetches within a 60-minute window. It says a scan ran from 2026/09/19 to 2026/10/19. CloudSEK states that its figures are minimum counts and that it did not execute any recovered files CloudSEK.

According to CloudSEK, the engine guesses credentials using 34 default credential pairs. It delivers payloads over netcat, wget, curl, TFTP, FTP and NFS. A small MIPS32 “stage2.so” payload beacons to a receiver and opens an interactive shell on TCP/4444 CloudSEK.

The following details are not confirmed:

  • Which specific vulnerabilities or CVEs the 59 modules use.
  • Which product versions are affected.
  • Who runs the operation.

Am I affected?

CloudSEK says the modules target the following device and service types CloudSEK:

  • Cameras.
  • Routers, including MikroTik/RouterOS.
  • ONUs.
  • Java-based services, including Jenkins and Openfire.

You may be exposed if you run any of these on the internet, especially with default or weak credentials. The source does not name the affected vendors beyond MikroTik, Jenkins and Openfire, and it lists no versions or CVEs.

CloudSEK lists these indicators CloudSEK:

  • An initial GET / request with the header User-Agent: Hello World.
  • Staging hosts 16.5.0[.]225 and 16.5.0[.]226.
  • Beacon receiver 45.205.1[.]9.
  • ICMP beacons.
  • An interactive shell listening on TCP/4444.

What to do now

  1. Replace default and weak credentials on routers, cameras, ONUs and MikroTik/RouterOS devices. CloudSEK says the engine relies on default credential pairs and recorded thousands of RouterOS logins.
  2. Check whether Jenkins and Openfire instances are reachable from the internet. Review Openfire for plugins you did not install.
  3. Search web and firewall logs for User-Agent: Hello World and for traffic to or from 16.5.0[.]225, 16.5.0[.]226 and 45.205.1[.]9.
  4. Look for devices listening on TCP/4444 or sending unexpected ICMP traffic to 45.205.1[.]9. Treat any match as compromised and rebuild or reflash it.
  5. Monitor for vendor advisories or CVE details. Specific vulnerabilities used by the campaign are not confirmed.

Sources