RWP Ventures RWP VenturesIntelligence

Historical intelligence backfill. This assessment covers reporting originally published on 2026-07-06 and was added to the RWP archive on 2026-09-07.

Daily Top · OT

Spring 2026 IoT botnets came in Go — Apex2 and c2c/meow, not a new ICS worm

Nozomi Labs 6 July 2026 — reusable Go, open-source parts, commodity C2. Apex2 does HTTP/UDP/TLS floods including Cloudflare-fronted and gaming targets. c2c/meow hit their SSH honeypot with no VT hits at first.

RWP Ventures · 2026-09-07 · event 2026-04-01 · 1 min read · priority 7.2

Bottom line up front

CONFIRMED Nozomi Labs, 6 July 2026 (EN; JP 7 July) — two Go samples from spring 2026 operations. Apex2: evolved Windows/Linux botnet, C2-directed HTTP(S)/UDP/TLS floods, including Cloudflare-protected sites, Discord, gaming; debug strings made analysis easy. c2c/meow: simpler SSH-scanner + C2 + persistence (copy to system dir, fake service) + ICMP/UDP/TCP/DNS/HTTP floods; first seen on a Nozomi SSH honeypot with no VirusTotal malicious detections at the time. Thesis: Go + OSS + automation collapsed the cost of a working DDoS bot. Not ICS malware. OT relevance: exposed Linux/IoT on plant perimeters become DDoS nodes and footholds. Distinct from Akamai's September Go worm (Langflow CVE-2026-33017) and Unit 42 TuxBot v3 — do not merge.

Historical backfill of 6 July 2026 reporting; added 7 September 2026.

What happened

Mirai did not die. It got a compiler and a package manager.

Why it mattered

Your internet-facing RTU Linux is a botnet candidate before it is a process-safety incident.

Who / what was affected

Exposed IoT/Linux. DDoS victims as named classes (CDN, gaming), not a plant outage list.

Technical context

Close SSH on WAN. Unique creds. Do not run random Go binaries from /tmp. Hunt fake systemd services.

Exploitation / threat status at the time

CONFIRMED Labs samples + honeypot.

UNKNOWN OT process effects.

What defenders should have done

  1. Perimeter IoT census.
  2. Block outbound floods from plant DMZ.
  3. Treat "no VT detection" as the default for week-old Go bots.

RWP assessment

Confidence: High as botnet research. Do not brief as FrostyGoop.

Defensive actions

  1. SSH and default-cred eradication on IoT.
  2. Egress controls.
  3. Keep Tengu/Aisuru/TuxBot as sibling families, separate posts.

Sources

  1. Nozomi Networks Labs — Spring botnet floods — Golang malware vs exposed IoT
  2. Industrial Cyber — Apex2 and c2c Golang malware
  3. Unit 42 — TuxBot v3 (separate LLM-assisted IoT botnet, July 2026)

Related intelligence