A new variant of the “BotenaGo” botnet has been discovered by Nozomi Networks security researchers. In October 2021, the original source code to BotenaGo was leaked to the public, allowing security researchers to analyze the underlying code. The original malware has the potential to target millions of IoT devices utilizing over thirty (30) exploits. The newest sample has been stripped of most of the exploit functions, creating a lean, stealthy virus that has gone undetected in VirusTotal and other anti-malware scanners. The variant specifically targets a bug in Lilin security camera DVR devices, which was initially discovered and patched in February 2020. The remote code execution (RCE) vulnerability present in these devices was initially exploited by the Chalubo, Fbot, and Moobot botnets and was also included in the original version of BotenaGo. When the malware is executed, it scans IP addresses collected from Shodan and other mass scanners. If it finds a vulnerable device, it will execute the “infectFunctionLilinDvr” function which attempts to exploit the device by first brute forcing credentials, then crafting an HTTP POST request which allows command execution. Multiple payloads are hosted on the command and control (C2) server targeting ARM, Motorola 68000, MIPS, PowerPC, SPARC, SuperH, and x86 architectures. The payloads contain a Mirai-based botnet which include a larger list of exploits. While not a great threat to organizations due to its targeted exploit, this new campaign shows that even well-known and documented malware can be used to create a botnet that is stealthy and remains undetected.