The Mirai-based botnet Moobot has begun spreading through a command injection flaw in Hikvision security camera products. The vulnerability, given the identifier CVE-2021-36260, was fixed in September 2021 but not all users have been quick to update. The botnet exploiting this flaw has been seen in the wild since February of this year and seems to be an offshoot of Satori, another Mirai botnet whose developer was arrested in the summer of 2020. It has multiple similarities to the other strain, though with the operators adding new vulnerabilities it is clear that Moobot is still in development. Once the botnet infects a host, it drops a downloader for the full Moobot malware then waits for commands from its command and control server (C2). The C2 can issue a command to launch a distributed denial of service (DDoS) attack to targets across the internet. Fortinet researchers who discovered the upgraded botnet also found a Telegram channel that started offering DDoS attacks since last August which is possibly related to Moobot. Hikvision customers are urged to upgrade their devices to prevent Moobot from spreading.