Back Gbhackers

Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15

Gbhackers •Mayura Kathir • March 19, 2026

A misconfigured open directory on an Iranian server has exposed a live censorship-bypass relay and SSH-based botnet operation, revealing how a single actor stitched together a 15-node network across Iran and Finland using commodity tools and sloppy operational security. The discovery shows how financially or personally motivated actors can reuse tradecraft seen in Iranian APT […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iran-Linked Botnet Exposed via Open Directory Leak A misconfigured open directory on an Iranian server has exposed a botnet operation linked to Iranian threat actors. This incident revealed a 15-node relay network and a mass SSH deployment framework, highlighting the operational security flaws of the actor. The exposed infrastructure includes DDoS tooling compiled on victim machines, indicating a potential for widespread disruption. The botnet spans across Iran and Finland, showcasing the international reach of the operation. Researchers gained insights into the methods employed by the actor, which include the use of commodity tools. The current status of the botnet is unclear, but the exposure raises alarms about its capabilities. This incident reflects the ongoing challenges in cybersecurity related to state-sponsored operations. The findings may prompt further investigations and responses from cybersecurity agencies. 2 sources 60

Extracted Entities

Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15

The full story

Extracted Entities

Attack Types (1)

Countries (2)

MITRE ATT&CK (1)

Tools (1)