Bashlite Botnet: New IoT Payload Delivery Infrastructure

Abuse.ch has identified 14 new malicious URLs linked to the Bashlite (also known as Gafgyt) IoT botnet. These indicators, observed on 2026-11-04, point to binary payloads tailored for multiple CPU architectures, including ARM, MIPS, PowerPC, SPARC, and x86_64. The infrastructure is centralized on the IP address 181.214.147.11.

Impact

The identified indicators represent active payload delivery vectors. Bashlite typically targets internet-exposed IoT devices to incorporate them into botnets for distributed denial-of-service (DDoS) operations.

Recommendation

• Block all ingress and egress traffic to/from the IP address 181.214.147.11 at the perimeter firewall and web proxy.
• Audit network logs for any successful HTTP GET requests to the identified URLs, as these indicate potential device infection.
• Implement outbound traffic filtering to prevent IoT devices from downloading arbitrary binaries from unknown external web servers.