Dubbed Enemybot, the botnet appears to be the work of Keksec, an established cybercrime group that specializes in DDoS attacks and cryptocurrency mining.

The malware was built using the source code of the Gafgyt (Bashlite) botnet – which leaked in 2015 – with some modules borrowed from the infamous Mirai botnet, including the scanner module and a bot killer module.

Enemybot employs several obfuscation techniques meant not only to prevent analysis, but also to keep it hidden from other botnets, and connects to a command and control (C&C) server on the Tor network.