New Malware Strains Exploit Network Devices for DDoS and Crypto Mining On March 6, 2026, security researchers uncovered two previously undetected malware strains CondiBot and Monaco targeting Linux-based routers, IoT devices, and enterprise network equipment. Both strains evaded major threat intelligence platforms, including VirusTotal and ThreatFox, until their discovery. CondiBot, a Mirai-based DDoS botnet, infects devices by cycling through multiple file transfer utilities (wget, curl, tftp, ftpget) to deliver its payload. Once executed, it disables reboot utilities, registers with a command-and-control (C2) server, and awaits attack commands. The malware includes 32 attack modules an expansion from earlier variants and actively kills competing botnets to monopolize system resources. A new internal identifier, "QTXBOT," suggests a possible fork or separate development group. Monaco, written in Go 1.24.0, brute-forces weak SSH credentials to deploy Monero cryptocurrency mining software on compromised servers, routers, and IoT devices. Unlike CondiBot, it focuses on stealthy resource exploitation rather than DDoS attacks. Researchers from Eclypsium noted that these campaigns reflect a broader trend: financially motivated threat actors are increasingly targeting network infrastructure, a tactic once dominated by nation-state groups. The 2025 Verizon Data Breach Investigation Report highlighted an 8x increase in exploits targeting network devices, with a median patching time of 30 days far slower than the zero-day exploit window. Google Threat Intelligence Group further reported that 25% of all zero-day exploits in 2025 targeted network and security systems. A critical challenge is the visibility gap in enterprise security. Most endpoint detection tools cannot monitor embedded firmware in network appliances, allowing attackers to operate undetected for extended periods. CondiBot’s persistence mechanisms including hardware watchdog manipulation make infections difficult to remove without physical intervention. The emergence of these strains underscores the growing threat to network infrastructure, where unpatched devices and weak credentials create prime targets for both DDoS and cryptojacking operations.