“BotenaGo”, a rising botnet written in Golang (Go), has been discovered utilizing thirty-three (33) exploits to target millions of IoT devices and routers. AT&T Alien Labs researchers, in their report linked below, unveiled that the malware has a “low antivirus (AV) detection rate with only 6/62 known Avs” seen in popular tool VirusTotal but is also detected as “Mirai”, a botnet with a different malware architecture as well as different attack functions. Researchers specified that BotenaGo has two (2) methods of receiving commands to target victims. The first method is by creating “two backdoor ports: 31412 and 19412”, where it will listen for an IP address through port 19412. Once a target IP address is received, the botnet will exploit each vulnerability in order to gain access. The second method is by setting up “a listener to system IO (terminal) user input” where it can receive a target. Researchers emphasized that BotenaGo does not have active communication with its command-and-control (C2) server so three (3) theories were established as to how it operates: “the malware is part of a ‘malware suite’ and BotenaGo is only one module of infection in an attack”, “the links used for the payload on a successful attack imply a connection with Mirai malware”, or “this malware is still in beta phase and has been accidentally leaked”. Once access is achieved overall, BotenaGo will execute remote shell commands to draft the targeted device into the botnet. The threat group behind this malware is currently unknown as well as the total number of infected devices. The specific exploits utilized by BotenaGo as well as detection methods and indicators of compromise (IOCs) can be viewed in AT&T Alien Labs’ report.