“Enemybot,” an internet of things (IoT) botnet, has been observed expanding its potential target scope by exploiting critical vulnerabilities that allow it to spread to new types of devices. AT&T Alien Labs researchers detailed that the malware is now targeting IoT devices, web servers, Android devices, and content management system (CMS) servers via exploiting recently disclosed critical vulnerabilities in various software and systems. Some of the targeted services include VMware Workspace ONE, WordPress, Adobe ColdFusion, and PHP Scriptcase. Enemybot was first discovered in March 2022 by Securonix researchers and is suspected to be distributed by the Keksec threat group (also known as Kek Security or FreakOut). The original botnet code used by Enemybot is comprised of Mirai, Qbot, and Zbot, as well as custom developments made by the threat actor. The malware exploits twenty-four (24) vulnerabilities, including Log4j (CVE-2021-44228 and CVE-2021-45046), a F5 BIG IP remote code execution (RCE) flaw (CVE-2022-1388), and a VMware Workspace ONE RCE flaw (CVE-2022-22954). Enemybot also exploits vulnerabilities not yet tracked via CVE, such as a Razer Sila command injection flaw (April 2022), a PHP Scriptcase 9.7 RCE flaw (April 2022), and an Adobe ColdFusion 11 RCE flaw (February 2022). It is recommended that administrators enable automatic software updates, utilize a configured firewall, maintain minimal exposure to the Internet, and monitor network traffic for unusual activity. A full list of exploited vulnerabilities, indicators of compromise (IOCs), and a deeper technical analysis of Enemybot can be viewed in Alien Labs report linked below.