CloudSEK published a report on 28 October 2026 about a botnet it calls Doorway. In October its researchers found two identical open directories left exposed by the operators, holding about 41 GB of working data: source code, scan results, logs and notes. That gives an unusually direct look at how a campaign against home and small office network gear is run.

What the toolkit targets

The core is an engine written in Rust, about 21,870 lines long, with 59 exploit modules. They cover IP cameras, routers and optical network terminals (ONUs, the fibre boxes ISPs install), plus Java server software such as Openfire, Jenkins, Tomcat and ActiveMQ. The engine carries 34 default username and password pairs and saves credentials that work, so it gets better at guessing as it goes.

One scan ran from 19 September to 19 October 2026. The figures CloudSEK pulled from the logs include:

  • 7,369 successful logins to MikroTik RouterOS across 4,923 device identities, many with SOCKS proxy settings added
  • 4,671 module join records from 4,217 IP addresses
  • 1,060 PPPoE subscriber records from a single ISP
  • 20 Jenkins remote code execution hits and 16 Openfire plugin uploads
  • 18 compromised ZBT and MoreQuick CPE routers through a module named DARKLANTERN
  • 1,772 victim IP addresses that could be geolocated

The operator's own ledger recorded 11,363 joins and 58,920 payload fetches in a single 60-minute window. The files also include a RouterOS exploit for CVE-2023-30799 that drops a MIPS reverse shell. CloudSEK could not confirm it works at scale: the field log shows three attempts, all failed.

How it is run

Payload links are signed with HMAC and tied to the victim's IP address, so a researcher cannot simply download them. Requests use the User-Agent string "Hello World". A file named WATCHER-BRIEF.md reads like a handover note for an operations team, and CloudSEK says the sessions point to the use of LLM tooling. The campaign was still active when the report came out.

What to check

Most of the hits rely on two things: admin panels reachable from the internet and passwords nobody changed. CloudSEK recommends:

  • removing internet-facing admin access on cameras, routers and ONUs
  • changing default credentials
  • turning off Telnet and UPnP where you do not need them
  • checking MikroTik devices for a SOCKS proxy on port 1080 and for unexpected accounts such as "admin" or "devel" that you did not create

If a MikroTik router at home or in a small office suddenly has proxy settings you never made, treat it as compromised and reset it.