The Register reports that Androxgh0st, a new hybrid botnet, has taken the lead as the most prevalent malware globally, impacting around 5% of organizations worldwide in the month of November. Researchers suspect with low confidence that the botnet is operated by Chinese threat actors based on its targeting of a hospital in Hong Kong last year and its focus on compromising technology primarily used in China. Androxgh0st is a hybrid botnet in that it targets both web servers and IoT devices, commonly exploiting known vulnerabilities to compromise devices recruited into the botnet for follow-on attacks including denial of service, surveillance, and data theft. The botnet’s prevalence had increased following the exit of a well-known botnet named “Mozi” last year. Researchers believe that Androxgh0st will likely ramp up its infections by two-fold in 2025. Androxgh0st targets vulnerabilities in multiple technologies including Cisco ASA, Atlassian JIRA, Sophos Firewalls, PHP frameworks, and IoT devices. The malware is capable of stealing sensitive information including credentials and AWS keys, using Laravel files to collect the information. The botnet is notable for its reach and ability to infect a range of targets including Mac, Linux, Windows, and IoT devices. CTIX analysts recommend that organizations stay on top of patching known vulnerabilities, as this is Androxgh0st’s main route of infection. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.