Thousands of internet-connected routers and network devices have been caught up in a global hacking operation designed to turn vulnerable infrastructure into a network of compromised systems.
The attackers targeted home and business routers, surveillance cameras, internet service provider (ISP) infrastructure and enterprise servers, using automated tools to identify vulnerable systems, gain access and deploy malicious software.
The operation, known as Doorway, came to light after cybersecurity firm CloudSEK identified two exposed attacker workspaces in October 2026. An investigation of approximately 41 GB of operational data revealed the source code, malware payloads, credential records, victim logs and internal instructions used to run the campaign.
The findings offer a detailed look at how the attackers built and managed their operation, from scanning internet-connected devices and testing passwords to deploying malicious software and monitoring compromised systems.
Thousands of routers and network devices affected
The scale of the operation becomes clear from the records left behind by the attackers.
CloudSEK researchers identified 7,369 successful MikroTik/RouterOS authentications across 4,923 device identities, along with 4,671 device-recruitment records involving 4,217 distinct IP addresses.
The targeted infrastructure included home routers, business networking equipment, surveillance cameras, digital video recorders, fibre-optic network terminals and internet-facing enterprise services.
Researchers also identified 1,772 victim-device IP addresses with associated geographic locations, providing evidence of the campaign’s international reach.
In one instance, the recovered records contained 1,060 PPPoE subscriber entries associated with a single internet service provider. The attackers also configured SOCKS proxy capabilities on MikroTik devices, indicating an effort to use compromised network infrastructure to relay traffic.
This creates a broader security concern. A compromised router is not necessarily the final target of an attack. It can become part of the infrastructure attackers use to route traffic and support further malicious activity.
Attackers also targeted enterprise servers
The operation was not limited to home routers and other internet-connected devices.
CloudSEK’s investigation identified 20 Jenkins servers with confirmed remote code execution and 16 Openfire plugin uploads across non-laboratory targets.
Jenkins is widely used to automate software development processes, while Openfire provides real-time messaging services. Their inclusion shows how the attackers expanded their activities beyond consumer and ISP infrastructure to systems used by businesses.
The recovered toolkit contained 59 exploitation modules targeting different devices and services. Its central scanning and delivery engine, written in Rust, consisted of approximately 21,870 lines of code.
The engine could identify a device, match it against known weaknesses, test credentials and attempt to deliver a suitable malicious payload. It also recorded successful and unsuccessful authentication attempts, allowing operators to improve their choice of credentials.
Rather than relying on one attack technique, the operators built a system capable of handling multiple devices, architectures and delivery methods.
The operation was managed like a technology project, with AI-linked tools
Among the recovered files was an internal document titled WATCHER-BRIEF.md, which described how the operators monitored performance, assigned tasks and changed their approach when attacks stopped producing results.
The document outlined five concurrent agent sessions with different responsibilities. Some focused on maintaining existing operations, while others searched for vulnerable Java servers, Windows systems and additional targets.
The recovered material also contained references to large language model tools, but the AI model/tool used by the attacker remains unknown. The workspace contains concrete, program-level evidence that the actor’s scripts were driven by an AI model and the model’s decisions were carried out. The workspace contains session transcript-style logs that show tool calls and their resulting actions. Also, the watcher model, the doorway-rs engine and the log activity collectively demonstrate that the actors’ script was executed, commands were issued and outcomes were recorded. These logs are the evidence beyond the intended-behaviour description.
The workflow tracked successful exploitation, monitored activity and directed attention towards new targets when existing methods became less effective.
This indicates that the operators were using automation and LLM-linked tooling to help manage a complex hacking operation. The available evidence, however, does not establish that AI independently carried out every attack or operational decision.
An operation designed to find, exploit and recruit devices at scale
The attackers developed a multi-stage process to move from discovering a vulnerable system to deploying malicious software.
First, the scanning engine identified internet-facing devices and checked their responses against known characteristics. It then selected relevant exploitation modules and attempted to gain access using vulnerabilities or credentials.
Once access was obtained, lightweight loaders could identify the device’s operating system and processor architecture before retrieving a suitable payload.
The operators supported several delivery methods, including wget, curl, FTP, TFTP and netcat, to account for differences in device capabilities and network restrictions.
The recovered code also included mechanisms to verify whether malicious components had executed, rather than counting every download attempt as a successful compromise.
An internal ledger maintained by the operators reported 11,363 device joins and 58,920 payload fetches in a 60-minute period. These figures are based on attacker-maintained records and were not independently verified.
CloudSEK also identified the infrastructure supporting the campaign, including scanning addresses, payload servers and systems used to receive signals from compromised devices.
Why the operation matters
The Doorway investigation shows how exposed internet infrastructure can be exploited through a combination of known vulnerabilities, weak credentials and automated attack tools.
For individuals and businesses, a poorly secured router or network device can become part of a larger malicious network without the owner necessarily recognising the compromise.
For internet service providers, compromised customer equipment and network infrastructure can create additional security risks. For enterprises, vulnerable internet-facing services such as Jenkins and Openfire present another route for attackers to gain access.
The operation also demonstrates how attackers can organise exploitation as a continuous process, measuring results, refining techniques and shifting to new targets as opportunities change.
CloudSEK recommends that organisations update internet-facing devices and services, replace default or weak passwords, restrict unnecessary remote management access and monitor unusual authentication attempts, proxy configurations and outbound network connections.
The investigation establishes substantial exploitation activity and evidence of proxy infrastructure development. However, the full command-and-control capabilities of the operation, its downstream use of compromised devices and the extent of any commercial activity remain unconfirmed.
For More Information, Read The Full Report
Related
This entry was posted on October 28, 2026 at 9:14 am and is filed under Commentary with tags CloudSEK. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Global Botnet Operation Compromises Thousands of Routers and Network Devices, Targets Enterprise Servers Worldwide
Thousands of internet-connected routers and network devices have been caught up in a global hacking operation designed to turn vulnerable infrastructure into a network of compromised systems.
The attackers targeted home and business routers, surveillance cameras, internet service provider (ISP) infrastructure and enterprise servers, using automated tools to identify vulnerable systems, gain access and deploy malicious software.
The operation, known as Doorway, came to light after cybersecurity firm CloudSEK identified two exposed attacker workspaces in October 2026. An investigation of approximately 41 GB of operational data revealed the source code, malware payloads, credential records, victim logs and internal instructions used to run the campaign.
The findings offer a detailed look at how the attackers built and managed their operation, from scanning internet-connected devices and testing passwords to deploying malicious software and monitoring compromised systems.
Thousands of routers and network devices affected
The scale of the operation becomes clear from the records left behind by the attackers.
CloudSEK researchers identified 7,369 successful MikroTik/RouterOS authentications across 4,923 device identities, along with 4,671 device-recruitment records involving 4,217 distinct IP addresses.
The targeted infrastructure included home routers, business networking equipment, surveillance cameras, digital video recorders, fibre-optic network terminals and internet-facing enterprise services.
Researchers also identified 1,772 victim-device IP addresses with associated geographic locations, providing evidence of the campaign’s international reach.
In one instance, the recovered records contained 1,060 PPPoE subscriber entries associated with a single internet service provider. The attackers also configured SOCKS proxy capabilities on MikroTik devices, indicating an effort to use compromised network infrastructure to relay traffic.
This creates a broader security concern. A compromised router is not necessarily the final target of an attack. It can become part of the infrastructure attackers use to route traffic and support further malicious activity.
Attackers also targeted enterprise servers
The operation was not limited to home routers and other internet-connected devices.
CloudSEK’s investigation identified 20 Jenkins servers with confirmed remote code execution and 16 Openfire plugin uploads across non-laboratory targets.
Jenkins is widely used to automate software development processes, while Openfire provides real-time messaging services. Their inclusion shows how the attackers expanded their activities beyond consumer and ISP infrastructure to systems used by businesses.
The recovered toolkit contained 59 exploitation modules targeting different devices and services. Its central scanning and delivery engine, written in Rust, consisted of approximately 21,870 lines of code.
The engine could identify a device, match it against known weaknesses, test credentials and attempt to deliver a suitable malicious payload. It also recorded successful and unsuccessful authentication attempts, allowing operators to improve their choice of credentials.
Rather than relying on one attack technique, the operators built a system capable of handling multiple devices, architectures and delivery methods.
The operation was managed like a technology project, with AI-linked tools
Among the recovered files was an internal document titled WATCHER-BRIEF.md, which described how the operators monitored performance, assigned tasks and changed their approach when attacks stopped producing results.
The document outlined five concurrent agent sessions with different responsibilities. Some focused on maintaining existing operations, while others searched for vulnerable Java servers, Windows systems and additional targets.
The recovered material also contained references to large language model tools, but the AI model/tool used by the attacker remains unknown. The workspace contains concrete, program-level evidence that the actor’s scripts were driven by an AI model and the model’s decisions were carried out. The workspace contains session transcript-style logs that show tool calls and their resulting actions. Also, the watcher model, the doorway-rs engine and the log activity collectively demonstrate that the actors’ script was executed, commands were issued and outcomes were recorded. These logs are the evidence beyond the intended-behaviour description.
The workflow tracked successful exploitation, monitored activity and directed attention towards new targets when existing methods became less effective.
This indicates that the operators were using automation and LLM-linked tooling to help manage a complex hacking operation. The available evidence, however, does not establish that AI independently carried out every attack or operational decision.
An operation designed to find, exploit and recruit devices at scale
The attackers developed a multi-stage process to move from discovering a vulnerable system to deploying malicious software.
First, the scanning engine identified internet-facing devices and checked their responses against known characteristics. It then selected relevant exploitation modules and attempted to gain access using vulnerabilities or credentials.
Once access was obtained, lightweight loaders could identify the device’s operating system and processor architecture before retrieving a suitable payload.
The operators supported several delivery methods, including wget, curl, FTP, TFTP and netcat, to account for differences in device capabilities and network restrictions.
The recovered code also included mechanisms to verify whether malicious components had executed, rather than counting every download attempt as a successful compromise.
An internal ledger maintained by the operators reported 11,363 device joins and 58,920 payload fetches in a 60-minute period. These figures are based on attacker-maintained records and were not independently verified.
CloudSEK also identified the infrastructure supporting the campaign, including scanning addresses, payload servers and systems used to receive signals from compromised devices.
Why the operation matters
The Doorway investigation shows how exposed internet infrastructure can be exploited through a combination of known vulnerabilities, weak credentials and automated attack tools.
For individuals and businesses, a poorly secured router or network device can become part of a larger malicious network without the owner necessarily recognising the compromise.
For internet service providers, compromised customer equipment and network infrastructure can create additional security risks. For enterprises, vulnerable internet-facing services such as Jenkins and Openfire present another route for attackers to gain access.
The operation also demonstrates how attackers can organise exploitation as a continuous process, measuring results, refining techniques and shifting to new targets as opportunities change.
CloudSEK recommends that organisations update internet-facing devices and services, replace default or weak passwords, restrict unnecessary remote management access and monitor unusual authentication attempts, proxy configurations and outbound network connections.
The investigation establishes substantial exploitation activity and evidence of proxy infrastructure development. However, the full command-and-control capabilities of the operation, its downstream use of compromised devices and the extent of any commercial activity remain unconfirmed.
For More Information, Read The Full Report
Share this:
Like this:
Related
This entry was posted on October 28, 2026 at 9:14 am and is filed under Commentary with tags CloudSEK. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.