# P2P Botnets in the Wild: Pink, Hajime, Mozi, FritzFrog, and Panchan — Decentralized C2 Landscape (360 Netlab Continuous Monitoring)

> 360 Netlab's continuous-monitoring review profiles five active peer-to-peer (P2P) botnet families — Pink, Hajime, Mozi, FritzFrog, and Panchan. Their decentralized command-and-control (no single C2 server) makes takedown difficult. Ranking by size is Pink > Hajime > Mozi >> FritzFrog <> Panchan; FritzFrog and Panchan propagate via SSH weak-credential brute force, while Pink (the largest, peaking at ~1.6M devices) flashes router firmware for persistence.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0752
- **ID:** TL-2026-0752
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-17215, CVE-2018-10561, CVE-2018-10562, CVE-2014-8361

## Description

This intelligence consolidates 360 Netlab's ongoing tracking of the peer-to-peer (P2P) botnet ecosystem alongside the original family-specific research from 360 Netlab, Akamai, NSFOCUS, Kaspersky, and others. P2P botnets replace the classic centralized command-and-control (C2) server with a decentralized overlay network in which every infected node can relay commands, distribute payloads, and propagate the worm. Because there is no single point of failure, sinkholing or seizing one server does not dismantle the botnet, and operators can keep pushing signed configuration updates across the mesh. 360 Netlab tracks these networks with four strategies: active probing (sending crafted probe messages to enumerate peers), traversing recent-communications/peer lists held by DHT nodes, node-heartbeat injection (inserting forged nodes that maintain heartbeats on peer lists), and a 'wait and see' approach that forges DHT identities closer to a target key to capture incoming peer-discovery requests.

Pink is the largest P2P botnet tracked, having infected more than 1.6 million devices (the great majority in China), primarily MIPS-based fiber/broadband routers. NSFOCUS attributed initial compromise to a zero-day against specific broadband-device brands. Pink is a hybrid: it uses a central C2 for time-sensitive commands, a P2P layer for non-urgent instructions, and third-party services (a project hidden on GitHub or Baidu Tieba, plus hard-coded domains delivered over DNS-over-HTTPS, DoH) to bootstrap configuration. It uniquely re-flashes the original firmware of the fiber router after infection — embedding the downloader C2 and a supporting bootloader in the rewritten firmware — to achieve near-permanent control. Pink's purpose is DDoS and HTTP ad injection. A pronounced decline began around 2022-07-12 (dropping to roughly 20,000 daily active nodes), attributed by 360 Netlab to a nationwide cleanup effort by device vendors and C2-blocking actions in late August 2022.

Hajime emerged in October 2016 (months after Mirai). It builds its overlay as a trackerless torrent on top of the public BitTorrent DHT using dynamic info_hashes that rotate daily, and exchanges data with peers over uTorrent's Micro Transport Protocol (uTP). All BitTorrent communications are signed and encrypted using RC4 with private/public keys. Hajime self-propagates via three attack methods: TR-069/CWPM exploitation (the NewNTPServer command-injection vector, typically TCP 7547, sometimes 5555), Telnet default-password attacks, and the Arris cable-modem 'password of the day' attack. The config file carries a signed list of per-architecture 'atk' (attack) and '.i' (infection) modules; nodes search for `.i.xxx` and `atk.xxx` binaries by CPU type. After infection Hajime blocks ports 23, 7547, 5555, and 5358 to lock out Mirai and other competitors, and opens UDP/1457 plus a random high port for DHT/uTP. Infections skew heavily toward MIPS devices, with Iran historically the top country.

Mozi, first identified by 360 Netlab on 2019-12-03, is a DHT-based botnet named after its propagation samples Mozi.m and Mozi.a. It uses a BitTorrent-like DHT to record peer contact information and syncs encrypted configuration files across nodes. Mozi reuses Gafgyt code for common functions (single-instance enforcement, process-name modification, ACL modification) and Gafgyt attack code (HTTP/TCP/UDP DDoS), and later added a crypto-mining component. It spreads through weak/default Telnet credentials and unpatched CVEs including CVE-2017-17215 (Huawei HG532), CVE-2018-10561/CVE-2018-10562 (GPON home routers), and CVE-2014-8361 (Realtek SDK miniigd UPnP). Targets expanded to Netgear, Huawei, and ZTE network gateways; infections concentrated in India and China.

FritzFrog, first observed 2020-01-09, is a Golang, modular, multi-threaded, fileless worm with a completely proprietary P2P protocol written from scratch (no μTP/known protocol). It brute-forces SSH credentials against government, education, medical, banking, and telecom targets (500+ servers breached, including U.S./European universities and a railway company). On success it installs an RSA public key into the victim's authorized_keys for passwordless re-entry, runs in memory as processes named 'ifconfig' and 'nginx', and listens on TCP 1234 for commands. Payloads — including a 'libexec' XMRig-based Monero miner pointed at web.xmrpool.eu:5555 — are distributed as in-memory blobs split with hash tracking and retrieved via P2P 'getbin' or HTTPS to port 1234. The protocol uses AES symmetric encryption with Diffie–Hellman key exchange over JSON, implements 30+ commands, is UPX-packed, and has shipped in 20+ versions; nodes vote to distribute brute-force targets so no two attack the same host. Akamai noted a wallet relationship linking FritzFrog to Mozi.

Panchan, discovered 2022-03-19, is a Go (compiled 1.17.7–1.18) SSH worm and cryptominer. It propagates by SSH dictionary attacks (default creds such as root, ubuntu, debian, pi, user) and by harvesting SSH keys from ~/.ssh/id_rsa and known_hosts for lateral movement. Persistence is via a systemd service 'systemd-worker' with the binary copied to /bin/systemd-worker and a renamed 'xinetd' copy in a randomly named hidden folder under /. It opens TCP 1919 (plaintext P2P, firewalled open via iptables); peer messages start with 'pan-chan's mining rig hi!' and end with 'finish'. It runs xmrig and nbhash miners fileless via memfd_create (base64-decoded, memory-mapped), with NiceHash pool traffic over ports 3380/3387, and reports infections via a Discord webhook. Akamai found 209 peers (40 active), with education the top vertical, and the admin panel contained Japanese (katakana) text suggesting Japanese-fluent developers.

Defensive priorities: enforce strong, unique SSH credentials and key-only auth; monitor for the family-specific process names, ports, and persistence artifacts above; patch the Mozi CVEs on exposed IoT/routers; segment IoT/OT networks; and treat decentralized P2P C2 as resistant to single-point takedown — blocking and host-level eradication, not sinkholing, is the effective control.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1543 Create or Modify System Process
- T1542 Pre-OS Boot
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1046 Network Service Discovery
- T1021 Remote Services
- T1090 Proxy
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1496 Resource Hijacking
- T1498 Network Denial of Service

## Sources

- [P2P Botnets: Review - Status - Continuous Monitoring](https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/)
- [Mozi, Another Botnet Using DHT](https://blog.netlab.360.com/mozi-another-botnet-using-dht/)
- [FritzFrog: A New Generation of Peer-to-Peer Botnets (Akamai/Guardicore)](https://www.akamai.com/blog/security/fritzfrog-a-new-generation-of-peer-to-peer-botnets)
- [Panchan's Mining Rig: New Golang Peer-to-Peer Botnet (Akamai)](https://www.akamai.com/blog/security-research/new-p2p-botnet-panchan)
- [Researchers Uncover 'Pink' Botnet Malware That Infected Over 1.6 Million Devices](https://thehackernews.com/2021/11/researchers-uncover-pink-botnet-malware.html)
- [Hajime, the mysterious evolving botnet (Kaspersky Securelist)](https://securelist.com/hajime-the-mysterious-evolving-botnet/78160/)
- [Measurement and Analysis of Hajime, a Peer-to-peer IoT Botnet (NDSS)](https://www.cs.umd.edu/~dml/papers/hajime_ndss19.pdf)
- [Mozi IoT Botnet Now Also Targets Netgear, Huawei, and ZTE Network Gateways](https://thehackernews.com/2021/08/mozi-iot-botnet-now-also-targets.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0752