Bashlite - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/bashlite/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 13:28:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBashlite Botnet: New IoT Payload Delivery Infrastructurehttps://feed.craftedsignal.io/briefs/2026-11-bashlite-indicators/Thu, 05 Nov 2026 13:28:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-bashlite-indicators/ThreatFox has identified 14 new URLs hosted on a single IP address used for the delivery of Bashlite (Gafgyt) malware across various IoT CPU architectures.Abuse.ch has identified 14 new malicious URLs linked to the Bashlite (also known as Gafgyt) IoT botnet. These indicators, observed on 2026-11-04, point to binary payloads tailored for multiple CPU architectures, including ARM, MIPS, PowerPC, SPARC, and x86_64. The infrastructure is centralized on the IP address 181.214.147.11.

Impact

The identified indicators represent active payload delivery vectors. Bashlite typically targets internet-exposed IoT devices to incorporate them into botnets for distributed denial-of-service (DDoS) operations.

Recommendation

  • Block all ingress and egress traffic to/from the IP address 181.214.147.11 at the perimeter firewall and web proxy.
  • Audit network logs for any successful HTTP GET requests to the identified URLs, as these indicate potential device infection.
  • Implement outbound traffic filtering to prevent IoT devices from downloading arbitrary binaries from unknown external web servers.
]]>mediumadvisorybotnetiotmalwarebashlitegafgyt